Description
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMOTION SCOUT TIA V5.4 | — | — |
| Siemens | SIMOTION SCOUT TIA V5.5 | — | — |
| Siemens | SIMOTION SCOUT TIA V5.6 | < V5.6 SP1 HF7 | V5.6 SP1 HF7 |
| Siemens | SIMOTION SCOUT TIA V5.7 | < V5.7 SP1 HF1 | V5.7 SP1 HF1 |
| Siemens | SIMOTION SCOUT V5.4 | — | — |
| Siemens | SIMOTION SCOUT V5.5 | — | — |
| Siemens | SIMOTION SCOUT V5.6 | < V5.6 SP1 HF7 | V5.6 SP1 HF7 |
| Siemens | SIMOTION SCOUT V5.7 | < V5.7 SP1 HF1 | V5.7 SP1 HF1 |
| Siemens | SINAMICS STARTER V5.5 | — | — |
| Siemens | SINAMICS STARTER V5.6 | — | — |
| Siemens | SINAMICS STARTER V5.7 | < V5.7 HF2 | V5.7 HF2 |
Advisories 3
- ICSA-25-226-18 Siemens SIMOTION SCOUT, SIMOTION SCOUT TIA, and SINAMICS STARTER CISA ICS & IT advisories · Apr 16, 2026
- SSA-186293 SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER Siemens ProductCERT · Apr 14, 2026
- NCSC-2025-0246 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Aug 12, 2025