Skip to content
OpenAdvisories
High ICSA-25-226-22 1 CVE

Siemens Web Installer

Published Aug 12, 2025 · Updated Sep 15, 2026 · Revision 15

Vendor: Siemens Product: Automation License Manager V6.0 Product: Automation License Manager V6.2 Product: CEMAT V10.0 Product: CP PtP Param configuring interface Product: Create MyConfig (CMC) Product: Energy Support Library (EnSL) Product: FM Configuration Package Product: Modular PID CTRL Tool Product: MultiFieldbus Configuration Tool (MFCT) Product: Network Planner (SINETPLAN) Product: OpenPCS 7 V10.0 Product: OpenPCS 7 V9.1 Product: SIMATIC Automation Tool Product: SIMATIC Automation Tool SDK Windows Product: SIMATIC BATCH V10.0 Product: SIMATIC BATCH V9.1 Product: SIMATIC Control Function Library (CFL) V1.x Product: SIMATIC Control Function Library (CFL) V2.x Product: SIMATIC Control Function Library (CFL) V3.x Product: SIMATIC Control Function Library (CFL) V4.x Product: SIMATIC D7-SYS Product: SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8) Product: SIMATIC eaSie Document Skills Product: SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) Product: SIMATIC eaSie Workflow Skills Product: SIMATIC Energy Suite V17 Product: SIMATIC Energy Suite V18 Product: SIMATIC Energy Suite V19 Product: SIMATIC Logon V1.6 +110 more

Summary

The installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the affected applications downloaded e.g. via OSD (Online Software Delivery).

Siemens has released new versions for several affected products and recommends using the latest versions during setup and installation. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #15

    CISA Republication update based on Siemens ProductCERT SSA-282044 advisory

  2. #14

    Added fix version for SINETPLAN and TIA Portal V18; Updated affected version for Telecontrol and PowerControl to V9.1

  3. #13

    Added fix for D7-SYS, Automation Tool, Automation Tool SDK Windows and Updated PDM MS V5.0, Process Historian 2022,PCS 7 Advanced Process Functions,PCS 7 Advanced Process Graphics,PCS 7 Logic Matrix V10.0,PCS 7 Advanced Process Library incl. Faceplates V10.0,BATCH V10.0,PCS 7 Industry Library V9.1 and V10.0,PCS 7/OPEN OS V9.1,PCS 7 PowerControl ,PCS 7 Standard Chemical Library V10.0 and V9.1,PCS 7 TeleControl,PDM V9.2,S7 F Systems V6.4,Safety Matrix, OpenPCS 7 V9.1 and V10.0 to no fix planned

  4. #12

    CISA Republication update based on Siemens ProductCERT SSA-282044 advisory

  5. #11

    Added fixes for Simatic Target, Simatic Wincc V7.5 and V8.0

  6. #10

    CISA Republication update based on Siemens ProductCERT SSA-282044 advisory

  7. #8

    CISA Republication - Updated remediation for SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)

  8. #9

    Updated remediation for SIMATIC ODK 1500S and SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)

  9. #7

    CISA Republication - Initial Republication of Siemens ProductCERT SSA-282044 advisory

  10. #6

    Added fixes for WinCC Panel Image Setup, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC Visualization Architect (SiVArc) V17, SIMATIC Process Historian 2024, SIMATIC PCS 7 Basis Library V10.0, SIMATIC Logon V2.0, SIMATIC PDM V9.3, and MultiFieldbus Configuration Tool (MFCT); Clarified that no fix is planned for TIA Project-Server V17

  11. #5

    Added fixes for TIA Project-Server, TIA Portal Cloud Connector, SIMATIC MTP CREATOR V5.x, SIMATIC S7-1500 Software Controller V3, Simatic Prosave, TIA Portal V20, V19, and V17 and updated Energy suite V17 and V18, SIMATIC S7-1500 Software Controller V2 with no fix planned

  12. #4

    Added Fixes for PCS 7 Logic Matrix V9.1, PCS7 Advanced Process Faceplates V9.1, SIMATIC PCS 7 Basis Faceplates V9.1 PCS 7 Basis Library V9.1, SIMATIC Management Agent V9.1, SIMATIC Management Console V9.1, PCS 7 V9.1, PCS 7 V10.0

  13. #3

    Added fix for MTP Creator V2.x, CFL V4.x, Simatic WinCC Unified Line Coordination and Simatic WinCC Unified Sequence

  14. #2

    Added Sahil Shah to acknowledgment; Added fix for SIMATIC Energy Suite V19, SIMATIC Energy Suite V20, SIMATIC MTP CREATOR V4.x, SIMATIC Control Function Library (CFL) V3.x, TIA Portal Test Suite V19, TIA Portal Test Suite V20, SIMATIC WinCC Visualization Architect V19, SIMATIC WinCC Visualization Architect V20, SIMATIC S7-PCT; Updated No fix planned for SIMATIC ProSave V17,SIMATIC WinCC flexible ES, SIMATIC Control Function Library (CFL) V1.x, SIMATIC Control Function Library (CFL) V2.x

  15. #1

    Publication Date

References