Skip to content
Fencer Vulns
medium 6.2

CVE-2023-30757 json

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation…

published 2023-06-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-35121

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions), Totally Integrated Automation Portal (TIA Portal) V20 (All versions). The know-how protection feature in affected products does not properly update the encryption of existing program blocks when a project file is updated.

This could allow attackers with access to the project file to recover previous - yet unprotected - versions of the project without the knowledge of the know-how protection password.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-166-06 updated cvss 6.2

Siemens TIA Portal

  • Siemens Totally Integrated Automation Portal (TIA Portal) V14 Siemens Totally Integrated Automation Portal (TIA Portal) V15 Siemens Totally Integrated Automation Portal (TIA Portal) V15.1 Siemens Totally Integrated Automation Portal (TIA Portal) V16 Siemens Totally Integrated Automation Portal (TIA Portal) V17 Siemens Totally Integrated Automation Portal (TIA Portal) V18
    +2 more products
    Siemens Totally Integrated Automation Portal (TIA Portal) V19 Siemens Totally Integrated Automation Portal (TIA Portal) V20
    affected: mitigation, no fix planned

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:T/RC:C
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Siemens Totally Integrated Automation Portal (TIA Portal) V14
  • Siemens Totally Integrated Automation Portal (TIA Portal) V15
  • Siemens Totally Integrated Automation Portal (TIA Portal) V15.1
  • Siemens Totally Integrated Automation Portal (TIA Portal) V16
  • Siemens Totally Integrated Automation Portal (TIA Portal) V17
  • Siemens Totally Integrated Automation Portal (TIA Portal) V18
  • Siemens Totally Integrated Automation Portal (TIA Portal) V19
  • Siemens Totally Integrated Automation Portal (TIA Portal) V20

Classification

Weakness
  • CWE-693 Protection Mechanism Failure

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.