Skip to content
OpenAdvisories
Medium SSA-186293 1 CVE

SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER

Published Aug 12, 2025 · Updated Apr 14, 2026 · Revision 3

Vendor: Siemens Product: SIMOTION SCOUT TIA V5.4 Product: SIMOTION SCOUT TIA V5.5 Product: SIMOTION SCOUT TIA V5.6 Product: SIMOTION SCOUT TIA V5.7 Product: SIMOTION SCOUT V5.4 Product: SIMOTION SCOUT V5.5 Product: SIMOTION SCOUT V5.6 Product: SIMOTION SCOUT V5.7 Product: SINAMICS STARTER V5.5 Product: SINAMICS STARTER V5.6 Product: SINAMICS STARTER V5.7

Summary

SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER are affected by an XXE injection vulnerability that could allow an attacker to access arbitrary application files.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #3

    Updated remediation to "No Fix is Planned" for SIMOTION SCOUT TIA V5.4 and V5.5

  2. #2

    Added fix for SINAMICS STARTER V5.7

  3. #1

    Publication Date

References