Siemens SIMATIC PCS neo V4.1

CVE-2025-30175

HIGH 8.7

En bref

Source: NVD
EPSS: EPSS 0.65 % · centile 51 (2026-10-31)
État: PUBLISHED
Publiée: 2025-05-13 09:38 UTC
Mise à jour: 2025-07-08 10:34 UTC
Attribuée par: siemens
Statut NVD: Analyzed

Rechercher sur…

Description

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote Connect (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions), Totally Integrated Automation Portal (TIA Portal) V20 (All versions), User Management Component (UMC) (All versions < V2.15.1.1). Affected products contain a out of bound write buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.

Faiblesses (CWE)

CWE-787 — Écriture hors limites

Références

https://cert-portal.siemens.com/productcert/html/ssa-614723.html

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	siemens
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	siemens
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · productcert@siemens.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2025-14392
GCVE · GCVE-0-2025-30175

Avis du CERT-FR

CERTFR-2025-AVI-0397 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:siemens:simatic_pcs_neo:4.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:simatic_pcs_neo:5.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:* < 4.0
cpe:2.3:a:siemens:sinema_remote_connect:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:totally_integrated_automation_portal:17:*:*:*:*:*:*:*
cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:*
cpe:2.3:a:siemens:totally_integrated_automation_portal:19:*:*:*:*:*:*:*
cpe:2.3:a:siemens:totally_integrated_automation_portal:20:*:*:*:*:*:*:*
cpe:2.3:a:siemens:user_management_component:*:*:*:*:*:*:*:* < 2.15.1.1

Produits affectés

Produit	Versions
Siemens · SIMATIC PCS neo V4.1	affected 0 < *
Siemens · SIMATIC PCS neo V5.0	affected 0 < *
Siemens · SINEC NMS	affected 0 < V4.0
Siemens · SINEMA Remote Connect	affected 0 < *
Siemens · Totally Integrated Automation Portal (TIA Portal) V17	affected 0 < *
Siemens · Totally Integrated Automation Portal (TIA Portal) V18	affected 0 < *
Siemens · Totally Integrated Automation Portal (TIA Portal) V19	affected 0 < *
Siemens · Totally Integrated Automation Portal (TIA Portal) V20	affected 0 < *
Siemens · User Management Component (UMC)	affected 0 < V2.15.1.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens SIMATIC PCS neo V4.1