CVE-2025-27127

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-08 · updated 2026-06-17
Weakness: CWE-434

Description

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.

Affected products

Siemens TIA Project-Server: before V2.1.1 — fixed in V2.1.1
Siemens TIA Project-Server V17: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V17: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V18: all versions
Siemens Totally Integrated Automation Portal (TIA Portal) V19: before V19 Update 4 — fixed in V19 Update 4
Siemens Totally Integrated Automation Portal (TIA Portal) V20: before V20 Update 3 — fixed in V20 Update 3

How to fix

Upgrade to a fixed version: Siemens TIA Project-Server V2.1.1; Siemens Totally Integrated Automation Portal (TIA Portal) V19 V19 Update 4; Siemens Totally Integrated Automation Portal (TIA Portal) V20 V20 Update 3. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-460466.html

Get alerted when CVE-2025-27127 or the next vulnerability affects your stack