CVE-2025-40759: Siemens TIA Portal RCE Vulnerability

CVE-2025-40759 Overview

CVE-2025-40759 is a type confusion vulnerability affecting a broad range of Siemens industrial engineering and automation software products, including SIMATIC STEP 7, SIMATIC WinCC, SIMATIC S7-PLCSIM, SIMOCODE ES, SIMOTION SCOUT TIA, SINAMICS Startdrive, SIRIUS Safety ES, SIRIUS Soft Starter ES, and TIA Portal Cloud. The affected products fail to properly sanitize stored security properties when parsing project files. An attacker who convinces an engineer to open a crafted project file can trigger type confusion and execute arbitrary code within the affected application. The flaw is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Successful exploitation enables arbitrary code execution on engineering workstations used to program and configure industrial control systems, providing attackers with a foothold into operational technology (OT) environments.

Affected Products

SIMATIC STEP 7 V17 (< V17 Update 9), V18 (all versions), V19 (< V19 Update 4), V20 (< V20 Update 4)
SIMATIC WinCC V17 (< V17 Update 9), V18 (all versions), V19 (< V19 Update 4), V20 (< V20 Update 4)
SIMATIC S7-PLCSIM V17, SIMOCODE ES V17–V20, SIMOTION SCOUT TIA V5.4–V5.7, SINAMICS Startdrive V17–V20, SIRIUS Safety/Soft Starter ES V17–V20, TIA Portal Cloud V17–V20

Discovery Timeline

2025-08-12 - CVE-2025-40759 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40759

Vulnerability Analysis

The vulnerability resides in the project file parsing logic shared by the Siemens TIA Portal ecosystem and related engineering tools. When the application loads a project file, it processes stored security properties without sufficient sanitization or type validation. A crafted project file can manipulate object metadata so that the parser interprets one object type as another, leading to a type confusion condition.

Type confusion of this nature provides an attacker control over memory interpretation. By coupling the unsafe property handling with the underlying deserialization process, an attacker can pivot from a malformed object into arbitrary code execution within the context of the engineering application. The flaw maps to CWE-502: Deserialization of Untrusted Data.

Root Cause

The root cause is improper sanitization of security properties stored inside project files. The parser trusts type information embedded in the serialized data and does not validate that deserialized objects match the expected schema before invoking type-specific operations.

Attack Vector

Exploitation requires user interaction. An engineer must open a malicious project file supplied through phishing, supply chain compromise, removable media, or a shared project repository. Once opened, the crafted file triggers the type confusion during the load operation. No network access to the workstation is required, and code executes with the privileges of the engineering user. Refer to the Siemens Security Advisory SSA-493396 for vendor technical details.

Detection Methods for CVE-2025-40759

Indicators of Compromise

Unexpected child processes spawned by TIA Portal binaries such as Siemens.Automation.PortalApp.exe or related engineering executables
Project files (.ap17, .ap18, .ap19, .ap20) originating from untrusted sources or arriving via email and removable media
Outbound network connections initiated by engineering software immediately after opening a project file
Creation of scripts, scheduled tasks, or persistence artifacts on engineering workstations following a project load event

Detection Strategies

Monitor process lineage on engineering workstations for anomalous children of TIA Portal and related Siemens applications
Alert on file write operations from engineering tools to locations outside designated project directories
Inspect project file archives for embedded executable content or unexpected serialized object types prior to opening

Monitoring Recommendations

Apply application allow-listing on OT engineering hosts and log denied execution attempts
Forward endpoint telemetry from engineering workstations to a centralized analytics platform for correlation with file open events
Track project file provenance using file hashing and source attribution within engineering change management systems

How to Mitigate CVE-2025-40759

Immediate Actions Required

Update affected products to fixed versions: SIMATIC STEP 7/WinCC V17 Update 9, V19 Update 4, V20 Update 4, SIMOTION SCOUT TIA V5.6 SP1 HF7, and TIA Portal Cloud V19 V5.2.1.1 / V20 V5.2.2.2
Open project files only from trusted sources and validate origin through internal change control before loading
Isolate engineering workstations from general-purpose corporate networks and restrict email and web access
Enforce least-privilege accounts for engineers performing project loads

Patch Information

Siemens has released updates for several affected products. Consult the Siemens Security Advisory SSA-493396 for the authoritative list of fixed versions and download locations. Versions marked as "all versions" without an update reference currently have no fix and require compensating controls.

Workarounds

Restrict project file exchange to vetted internal repositories with integrity verification
Use dedicated, hardened engineering workstations that do not process untrusted documents or browse the public internet
Apply Siemens operational guidelines for industrial security, including network segmentation per IEC 62443
Disable automatic opening of project files from network shares and removable media

bash

# Configuration example - reference only; consult Siemens advisory for product-specific guidance
# Validate project file origin via hash before opening
Get-FileHash -Algorithm SHA256 -Path "C:\Projects\incoming\project.ap20"