Description
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Totally Integrated Automation Portal (TIA Portal) V15 | — | — |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V16 | < V16 Update 7 | V16 Update 7 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V17 | < V17 Update 6 | V17 Update 6 |
| Siemens | Totally Integrated Automation Portal (TIA Portal) V18 | < V18 Update 1 | V18 Update 1 |
Advisories 6
- ICSA-25-324-05 Festo Didactic products CISA ICS & IT advisories · Oct 1, 2025
- FSA-202303 Festo: Vulnerable Siemens TIA-Portal in multiple Festo Didactic products CERT@VDE · Oct 1, 2025
- ICSA-23-103-08 Siemens Mendix Forgot Password Module CISA ICS & IT advisories · May 6, 2025
- ICSA-23-103-04 Siemens TIA Portal CISA ICS & IT advisories · Aug 13, 2024
- SSA-116924 SSA-116924: Path Traversal Vulnerability in TIA Portal Siemens ProductCERT · Aug 13, 2024
- WID-SEC-2023-0909 Siemens TIA Portal: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Apr 10, 2023