CVE-2025-23364 Overview
CVE-2025-23364 affects Siemens TIA Administrator versions prior to V3.0.6. The application improperly validates code signing certificates during installation operations. An attacker with local access can bypass signature verification and execute arbitrary code through the installer. The flaw is tracked under [CWE-347: Improper Verification of Cryptographic Signature]. Siemens published advisory SSA-573669 to address the issue.
Critical Impact
Local attackers can supply unsigned or maliciously signed installation payloads that TIA Administrator will accept and execute, leading to arbitrary code execution on engineering workstations used to manage industrial automation environments.
Affected Products
- Siemens TIA Administrator — all versions prior to V3.0.6
- Industrial engineering workstations running TIA Administrator components
- Systems that depend on TIA Administrator for Totally Integrated Automation (TIA) Portal updates
Discovery Timeline
- 2025-07-08 - CVE-2025-23364 published to the National Vulnerability Database (NVD)
- 2025-08-21 - Last updated in NVD database
Technical Details for CVE-2025-23364
Vulnerability Analysis
TIA Administrator handles installation and update tasks for Siemens Totally Integrated Automation (TIA) Portal engineering software. The application relies on code signing certificates to confirm that installation payloads originate from Siemens. CVE-2025-23364 stems from an improper implementation of this verification check.
The weakness allows an attacker to present an installation artifact whose signature is invalid, untrusted, or otherwise non-conformant, yet the verification routine returns success. Because TIA Administrator runs installation logic with elevated rights on engineering workstations, the bypass leads to arbitrary code execution in the context of the installer. The vulnerability requires local access and no user interaction, which matches the CVSS attack vector of AV:L with integrity impact only.
Root Cause
The root cause is improper verification of a cryptographic signature [CWE-347]. The signature validation routine does not enforce all required checks on the certificate chain or signature contents. As a result, payloads that should be rejected pass the trust evaluation. Siemens documents the corrected behavior in Siemens Security Advisory SSA-573669.
Attack Vector
Exploitation requires local access to a workstation that runs a vulnerable TIA Administrator version. An attacker stages a crafted installation package, then invokes TIA Administrator to process it. The improper signature check approves the package, and the installer executes attacker-controlled code. Supply chain scenarios, removable media drops, and post-compromise lateral movement in operational technology (OT) environments are realistic delivery paths.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-23364
Indicators of Compromise
- Unexpected child processes spawned by TIA Administrator installer binaries on engineering workstations
- Installation packages located outside Siemens-managed update directories that were processed by TIA Administrator
- New or modified files in TIA Administrator program directories that do not match a Siemens-issued update window
- Windows Application or Setup event log entries showing installation activity not initiated by an authorized engineer
Detection Strategies
- Inventory all engineering workstations to identify TIA Administrator builds older than V3.0.6
- Compare hashes of installed TIA Administrator executables against vendor-published reference hashes
- Alert on execution of installer payloads from non-standard paths such as user profile directories or removable media
- Correlate process creation telemetry with file write events targeting TIA Administrator directories
Monitoring Recommendations
- Forward endpoint process, file, and signature-verification telemetry from OT engineering workstations to centralized analytics
- Track use of administrative accounts that launch TIA Administrator outside scheduled maintenance windows
- Monitor removable media mount events on workstations authorized to run TIA Administrator
How to Mitigate CVE-2025-23364
Immediate Actions Required
- Upgrade TIA Administrator to V3.0.6 or later on every affected workstation
- Restrict local logon and installer execution rights to a small set of vetted engineering accounts
- Verify the authenticity of any TIA Administrator installation package out-of-band before execution
- Block use of unapproved removable media on engineering workstations
Patch Information
Siemens addressed CVE-2025-23364 in TIA Administrator V3.0.6. Apply the update on all impacted systems. Refer to Siemens Security Advisory SSA-573669 for download links, validation guidance, and any product-specific deployment notes.
Workarounds
- Operate TIA Administrator only on workstations isolated from general-purpose networks until the patch is deployed
- Enforce application allowlisting so that only Siemens-signed installer binaries can execute
- Limit physical and remote access to engineering workstations through privileged access workstation (PAW) controls
- Require dual control for any installation or update workflow that invokes TIA Administrator
# Configuration example: query installed TIA Administrator version on Windows
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*TIA Administrator*" } |
Select-Object DisplayName, DisplayVersion, InstallLocation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
