A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions < V16 Update 7), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 6), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 1). Affected products contain a path traversal vulnerability that could allow the creation or overwrite of arbitrary files in the engineering system. If the user is tricked to open a malicious PC system configuration file, an attacker could exploit this vulnerability to achieve arbitrary code execution.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf Patch, Vendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-116924.pdf Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.3 · siemensNVD modified 2026-10-23 23:10
Affected (CPE criteria) 9
cpe:2.3:a:siemens:tia_portal:15:*:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:16:*:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:17:-:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:17:update1:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:17:update2:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:17:update3:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:17:update4:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:17:update5:*:*:*:*:*:*cpe:2.3:a:siemens:tia_portal:18:-:*:*:*:*:*:*