Siemens TIA Project-Server
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Deferred
Description
A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.
Weaknesses (CWE)
- CWE-434 — Unrestricted Upload of File with Dangerous Type
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | siemens |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | siemens |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · productcert@siemens.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | NVD · productcert@siemens.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-20444
- GCVE · GCVE-0-2025-27127
CERT-FR advisories
- CERTFR-2025-AVI-0566 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Siemens · TIA Project-Server | affected 0 < V2.1.1 |
| Siemens · TIA Project-Server V17 | affected 0 < * |
| Siemens · Totally Integrated Automation Portal (TIA Portal) V17 | affected 0 < * |
| Siemens · Totally Integrated Automation Portal (TIA Portal) V18 | affected 0 < * |
| Siemens · Totally Integrated Automation Portal (TIA Portal) V19 | affected 0 < V19 Update 4 |
| Siemens · Totally Integrated Automation Portal (TIA Portal) V20 | affected 0 < V20 Update 3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |