A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5

Summary

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.

Timeline

1. Aug 12, 2025, 11:17 AM UTCCVE published
2. Aug 12, 2025, 1:30 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 14, 2025, 9:15 AM UTCRecord last updated

Affected versions

• Siemens SIMOTION SCOUT TIA V5.4

  All versions

• Siemens SIMOTION SCOUT TIA V5.5

  All versions

• Siemens SIMOTION SCOUT TIA V5.6

  fixed in V5.6 SP1 HF7

• Siemens SIMOTION SCOUT TIA V5.7

  fixed in V5.7 SP1 HF1

• Siemens SIMOTION SCOUT V5.4

  All versions

• Siemens SIMOTION SCOUT V5.5

  All versions

• Siemens SIMOTION SCOUT V5.6

  fixed in V5.6 SP1 HF7

• Siemens SIMOTION SCOUT V5.7

  fixed in V5.7 SP1 HF1

• Siemens SINAMICS STARTER V5.5

  All versions

• Siemens SINAMICS STARTER V5.6

  All versions

• Siemens SINAMICS STARTER V5.7

  fixed in V5.7 HF2

References 1