CVE-2025-30033

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-12 · updated 2026-10-13
Weakness: CWE-427

Description

The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.

Affected products

Siemens Automation License Manager V6.0: all versions
Siemens Automation License Manager V6.2: before V6.2 Upd3 — fixed in V6.2 Upd3
Siemens CEMAT V10.0: all versions
Siemens CP PtP Param configuring interface: all versions
Siemens Create MyConfig (CMC): before V6.9 — fixed in V6.9
Siemens Energy Support Library (EnSL): all versions
Siemens FM Configuration Package: all versions
Siemens Modular PID CTRL Tool: all versions
Siemens MultiFieldbus Configuration Tool (MFCT): before V1.5.5.0 — fixed in V1.5.5.0
Siemens OpenPCS 7 V10.0: all versions
Siemens OpenPCS 7 V9.1: all versions
Siemens Network Planner (SINETPLAN): before V2.0 SP2 — fixed in V2.0 SP2
Siemens SIMATIC Automation Tool: before V5.0 SP4 — fixed in V5.0 SP4
Siemens SIMATIC Automation Tool SDK Windows: before V5.0 SP4 — fixed in V5.0 SP4
Siemens SIMATIC BATCH V10.0: all versions
Siemens SIMATIC BATCH V9.1: all versions
Siemens SIMATIC Control Function Library (CFL) V1.x: all versions
Siemens SIMATIC Control Function Library (CFL) V2.x: all versions
Siemens SIMATIC Control Function Library (CFL) V3.x: before V3.1.0.2 — fixed in V3.1.0.2
Siemens SIMATIC Control Function Library (CFL) V4.x: before V4.1 — fixed in V4.1
Siemens SIMATIC D7-SYS: before V10.0 SP1 — fixed in V10.0 SP1
Siemens SIMATIC eaSie Core Package: all versions
Siemens SIMATIC eaSie Document Skills: all versions
Siemens SIMATIC eaSie PCS 7 Skill Package: all versions
Siemens SIMATIC eaSie Workflow Skills: all versions
Siemens SIMATIC Energy Suite V17: all versions
Siemens SIMATIC Energy Suite V18: all versions
Siemens SIMATIC Energy Suite V19: before V19 Update 4 — fixed in V19 Update 4
Siemens SIMATIC Logon V1.6: all versions
Siemens SIMATIC Logon V2.0: before V2.0 Upd3 — fixed in V2.0 Upd3

How to fix

Upgrade to a fixed version: Siemens Automation License Manager V6.2 V6.2 Upd3; Siemens Create MyConfig (CMC) V6.9; Siemens MultiFieldbus Configuration Tool (MFCT) V1.5.5.0; Siemens Network Planner (SINETPLAN) V2.0 SP2; Siemens SIMATIC Automation Tool V5.0 SP4; Siemens SIMATIC Automation Tool SDK Windows V5.0 SP4; Siemens SIMATIC Control Function Library (CFL) V3.x V3.1.0.2; Siemens SIMATIC Control Function Library (CFL) V4.x V4.1; Siemens SIMATIC D7-SYS V10.0 SP1; Siemens SIMATIC Energy Suite V19 V19 Update 4; Siemens SIMATIC Logon V2.0 V2.0 Upd3; Siemens SIMATIC Management Agent V9.1 SP1 Upd8. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-282044.html

Get alerted when CVE-2025-30033 or the next vulnerability affects your stack