Read the docs
TI-2025-27221 Aliases CVE-2025-40759GHSA-hgv7-qqgv-vj6c

Deserialization of untrusted data in Siemens SIMATIC S7-PLCSIM V17

Priority LOW 38CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions < V18 Update 6), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions < V17 Update 9), SIMATIC WinCC V18 (All versions < V18 Update 6), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions < V20 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions < V5.2.2.2). Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed SIMATIC STEP 7 V17 (Siemens): V17 Update 9SIMATIC STEP 7 V18 (Siemens): V18 Update 6+9 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC S7-PLCSIM V17all versions—No fix listedCNA
SiemensSIMATIC STEP 7 V17before V17 Update 9V17 Update 9Patch availableCNA
SiemensSIMATIC STEP 7 V18before V18 Update 6V18 Update 6Patch availableCNA
SiemensSIMATIC STEP 7 V19before V19 Update 4V19 Update 4Patch availableCNA
SiemensSIMATIC STEP 7 V20before V20 Update 4V20 Update 4Patch availableCNA
SiemensSIMATIC WinCC V17before V17 Update 9V17 Update 9Patch availableCNA
SiemensSIMATIC WinCC V18before V18 Update 6V18 Update 6Patch availableCNA
SiemensSIMATIC WinCC V19before V19 Update 4V19 Update 4Patch availableCNA
SiemensSIMATIC WinCC V20before V20 Update 4V20 Update 4Patch availableCNA
SiemensSIMOCODE ES V17all versions—No fix listedCNA
SiemensSIMOCODE ES V18all versions—No fix listedCNA
SiemensSIMOCODE ES V19all versions—No fix listedCNA
SiemensSIMOCODE ES V20all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.4all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.5all versions—No fix listedCNA
SiemensSIMOTION SCOUT TIA V5.6before V5.6 SP1 HF7V5.6 SP1 HF7Patch availableCNA
SiemensSIMOTION SCOUT TIA V5.7all versions—No fix listedCNA
SiemensSINAMICS Startdrive V17all versions—No fix listedCNA
SiemensSINAMICS Startdrive V18all versions—No fix listedCNA
SiemensSINAMICS Startdrive V19all versions—No fix listedCNA
SiemensSINAMICS Startdrive V20all versions—No fix listedCNA
SiemensSIRIUS Safety ES V17 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Safety ES V18 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Safety ES V19 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Safety ES V20 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Soft Starter ES V17 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Soft Starter ES V18 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Soft Starter ES V19 (TIA Portal)all versions—No fix listedCNA
SiemensSIRIUS Soft Starter ES V20 (TIA Portal)all versions—No fix listedCNA
SiemensTIA Portal Cloud V17all versions—No fix listedCNA
SiemensTIA Portal Cloud V18all versions—No fix listedCNA
SiemensTIA Portal Cloud V19before V5.2.1.1V5.2.1.1Patch availableCNA
SiemensTIA Portal Cloud V20before V5.2.2.2V5.2.2.2Patch availableCNA
  • SIMATIC S7-PLCSIM V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC STEP 7 V17 VendorSiemens Affected before V17 Update 9 Fixed in V17 Update 9 Patch available CNA
  • SIMATIC STEP 7 V18 VendorSiemens Affected before V18 Update 6 Fixed in V18 Update 6 Patch available CNA
  • SIMATIC STEP 7 V19 VendorSiemens Affected before V19 Update 4 Fixed in V19 Update 4 Patch available CNA
  • SIMATIC STEP 7 V20 VendorSiemens Affected before V20 Update 4 Fixed in V20 Update 4 Patch available CNA
  • SIMATIC WinCC V17 VendorSiemens Affected before V17 Update 9 Fixed in V17 Update 9 Patch available CNA
  • SIMATIC WinCC V18 VendorSiemens Affected before V18 Update 6 Fixed in V18 Update 6 Patch available CNA
  • SIMATIC WinCC V19 VendorSiemens Affected before V19 Update 4 Fixed in V19 Update 4 Patch available CNA
  • SIMATIC WinCC V20 VendorSiemens Affected before V20 Update 4 Fixed in V20 Update 4 Patch available CNA
  • SIMOCODE ES V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOCODE ES V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOCODE ES V19 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOCODE ES V20 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.4 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.5 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMOTION SCOUT TIA V5.6 VendorSiemens Affected before V5.6 SP1 HF7 Fixed in V5.6 SP1 HF7 Patch available CNA
  • SIMOTION SCOUT TIA V5.7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V19 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SINAMICS Startdrive V20 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Safety ES V17 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Safety ES V18 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Safety ES V19 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Safety ES V20 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Soft Starter ES V17 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Soft Starter ES V18 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Soft Starter ES V19 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIRIUS Soft Starter ES V20 (TIA Portal) VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • TIA Portal Cloud V17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • TIA Portal Cloud V18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • TIA Portal Cloud V19 VendorSiemens Affected before V5.2.1.1 Fixed in V5.2.1.1 Patch available CNA
  • TIA Portal Cloud V20 VendorSiemens Affected before V5.2.2.2 Fixed in V5.2.2.2 Patch available CNA

Remediation

  • Fix · CNA SIMATIC STEP 7 V17 (Siemens) Fixed in V17 Update 9
  • Fix · CNA SIMATIC STEP 7 V18 (Siemens) Fixed in V18 Update 6
  • Fix · CNA SIMATIC STEP 7 V19 (Siemens) Fixed in V19 Update 4
  • Fix · CNA SIMATIC STEP 7 V20 (Siemens) Fixed in V20 Update 4
  • Fix · CNA SIMATIC WinCC V17 (Siemens) Fixed in V17 Update 9
  • Fix · CNA SIMATIC WinCC V18 (Siemens) Fixed in V18 Update 6
  • Fix · CNA SIMATIC WinCC V19 (Siemens) Fixed in V19 Update 4
  • Fix · CNA SIMATIC WinCC V20 (Siemens) Fixed in V20 Update 4
  • Fix · CNA SIMOTION SCOUT TIA V5.6 (Siemens) Fixed in V5.6 SP1 HF7
  • Fix · CNA TIA Portal Cloud V19 (Siemens) Fixed in V5.2.1.1
  • Fix · CNA TIA Portal Cloud V20 (Siemens) Fixed in V5.2.2.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SIMOTION SCOUT TIA V5.6 V5.6 SP1 HF7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2024-36641 Deserialization of untrusted data in Siemens SIMATIC PCS neo V4.1Priority LOW 38
    • TI-2025-27068 XML external entity injection in Siemens SIMOTION SCOUT TIA V5.4Priority LOW 29
    Show all 3 records →
  • Release ·

    Siemens SIMATIC STEP 7 V17, SIMATIC STEP 7 V18 and 8 more products V17 Update 9, V18 Update 6 and 4 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-36641 Deserialization of untrusted data in Siemens SIMATIC PCS neo V4.1Priority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40759
  2. 2026-10-03 Alias added: GHSA-hgv7-qqgv-vj6c
  3. 2026-10-13 Title updated · CNA
  4. 2026-10-13 Fix available: Siemens/SIMATIC STEP 7 V18@V18 Update 6, Siemens/SIMATIC WinCC V18@V18 Update 6 · CNA

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences