Skip to content
Fencer Vulns
medium 4.3

CVE-2025-27127 json

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrate…

published 2025-07-08 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-20444

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.

Patch / fix

  • Siemens TIA Project-Server V2.1.1
  • Siemens Totally Integrated Automation Portal (TIA Portal) V19 V19 Update 4
  • Siemens Totally Integrated Automation Portal (TIA Portal) V20 V20 Update 3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-191-05 updated cvss 4.3

Siemens TIA Project-Server and TIA Portal

  • Siemens TIA Project-Server < 2.1.1
    affected: fixed in V2.1.1 support.industry.siemens.com
  • Siemens TIA Project-Server V17 Siemens Totally Integrated Automation Portal (TIA Portal) V17 Siemens Totally Integrated Automation Portal (TIA Portal) V18
    affected: no fix planned
  • Siemens Totally Integrated Automation Portal (TIA Portal) V19 <V19_Update_4
    affected: fixed in V19 support.industry.siemens.com
  • Siemens Totally Integrated Automation Portal (TIA Portal) V20 <V20_Update_3
    affected: fixed in V20 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Siemens TIA Project-Server
  • Siemens TIA Project-Server V17
  • Siemens Totally Integrated Automation Portal (TIA Portal) V17
  • Siemens Totally Integrated Automation Portal (TIA Portal) V18
  • Siemens Totally Integrated Automation Portal (TIA Portal) V19
  • Siemens Totally Integrated Automation Portal (TIA Portal) V20

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.