Skip to content
Fencer Vulns
high 7.8

CVE-2025-30033 json

The affected setup component is vulnerable to DLL hijacking.

published 2025-08-12 14 mo ago modified 2026-10-13 27 d ago also EUVD-2025-24250

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.

Patch / fix

  • Siemens Automation License Manager V6.2 V6.2 Upd3
  • Siemens Create MyConfig (CMC) V6.9
  • Siemens MultiFieldbus Configuration Tool (MFCT) V1.5.5.0
  • Siemens Siemens Network Planner (SINETPLAN) V2.0 SP2
  • Siemens SIMATIC Automation Tool V5.0 SP4
  • Siemens SIMATIC Automation Tool SDK Windows V5.0 SP4
  • Siemens SIMATIC Control Function Library (CFL) V3.x V3.1.0.2
  • Siemens SIMATIC Control Function Library (CFL) V4.x V4.1
  • Siemens SIMATIC D7-SYS V10.0 SP1
  • Siemens SIMATIC Energy Suite V19 V19 Update 4
  • Siemens SIMATIC Logon V2.0 V2.0 Upd3
  • Siemens SIMATIC Management Agent V9.1 SP1 Upd8
  • Siemens SIMATIC Management Console V9.1 SP1 Upd8
  • Siemens SIMATIC MTP CREATOR V2.x V2.1
  • Siemens SIMATIC MTP CREATOR V4.x V4.1.0.1
  • Siemens SIMATIC MTP CREATOR V5.x V5.0.0.1
  • Siemens SIMATIC NET PC Software V20 V20.0 Update 1
  • Siemens SIMATIC PCS 7 Advanced Process Faceplates V9.1 V9.1 SP2 Upd4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-226-22 updated cvss 7.8

Siemens Web Installer

  • Siemens Automation License Manager V6.0
    affected: mitigation, no fix planned
  • Siemens Automation License Manager V6.2 < 6.2.0.3
    affected: fixed in V6.2, mitigation support.industry.siemens.com
  • Siemens CEMAT V10.0
    affected: mitigation, no fix planned
  • Siemens CP PtP Param configuring interface
    affected: mitigation, no fix available
  • Siemens Create MyConfig (CMC) < 6.9
    affected: fixed in V6.9, mitigation support.industry.siemens.com
  • Siemens Energy Support Library (EnSL)
    affected: mitigation, no fix planned
  • Siemens FM Configuration Package Siemens Modular PID CTRL Tool
    affected: mitigation, no fix available
  • Siemens MultiFieldbus Configuration Tool (MFCT) < 1.5.5.0
    affected: fixed in V1.5.5.0, mitigation support.industry.siemens.com
show 17 more
  • Siemens OpenPCS 7 V9.1 Siemens OpenPCS 7 V10.0
    affected: mitigation, no fix planned
  • Siemens Network Planner (SINETPLAN) < 2.0.2
    affected: fixed in V2.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC Automation Tool < 5.0.4 Siemens SIMATIC Automation Tool SDK Windows < 5.0.4
    affected: fixed in V5.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC BATCH V9.1 Siemens SIMATIC BATCH V10.0 Siemens SIMATIC Control Function Library (CFL) V1.x Siemens SIMATIC Control Function Library (CFL) V2.x
    affected: mitigation, no fix planned
  • Siemens SIMATIC Control Function Library (CFL) V3.x < 3.1.0.2
    affected: fixed in V3.1.0.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC Control Function Library (CFL) V4.x < 4.1
    affected: fixed in V4.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC D7-SYS < 10.0.1
    affected: fixed in V10.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8) Siemens SIMATIC eaSie Document Skills Siemens SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) Siemens SIMATIC eaSie Workflow Skills Siemens SIMATIC Energy Suite V17 Siemens SIMATIC Energy Suite V18
    affected: mitigation, no fix available
  • Siemens SIMATIC Energy Suite V19 < 19.0.4
    affected: fixed in V19, mitigation support.industry.siemens.com
  • Siemens SIMATIC Logon V1.6
    affected: mitigation, no fix planned
  • Siemens SIMATIC Logon V2.0 < 2.0.0.3
    affected: fixed in V2.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC Management Agent < 9.1.1.8 Siemens SIMATIC Management Console < 9.1.1.8
    affected: fixed in V9.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC MTP CREATOR V2.x < 2.1
    affected: fixed in V2.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC MTP CREATOR V3.x
    affected: mitigation, no fix planned
  • Siemens SIMATIC MTP CREATOR V4.x < 4.1.0.1
    affected: fixed in V4.1.0.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC MTP CREATOR V5.x < 5.0.0.1
    affected: fixed in V5.0.0.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC MTP Integrator V1.x Siemens SIMATIC MTP Integrator V2.x Siemens SIMATIC NET PC Software V16 Siemens SIMATIC NET PC Software V17
    affected: mitigation, no fix available

99 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
14 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Siemens Automation License Manager V6.0
  • Siemens Automation License Manager V6.2
  • Siemens CEMAT V10.0
  • Siemens CP PtP Param configuring interface
  • Siemens Create MyConfig (CMC)
  • Siemens Energy Support Library (EnSL)
  • Siemens FM Configuration Package
  • Siemens Modular PID CTRL Tool
  • Siemens MultiFieldbus Configuration Tool (MFCT)
  • Siemens OpenPCS 7 V10.0
  • Siemens OpenPCS 7 V9.1
  • Siemens Siemens Network Planner (SINETPLAN)
  • Siemens SIMATIC Automation Tool
  • Siemens SIMATIC Automation Tool SDK Windows
  • Siemens SIMATIC BATCH V10.0
  • Siemens SIMATIC BATCH V9.1
  • Siemens SIMATIC Control Function Library (CFL) V1.x
  • Siemens SIMATIC Control Function Library (CFL) V2.x
  • Siemens SIMATIC Control Function Library (CFL) V3.x
  • Siemens SIMATIC Control Function Library (CFL) V4.x
  • Siemens SIMATIC D7-SYS
  • Siemens SIMATIC eaSie Core Package
  • Siemens SIMATIC eaSie Document Skills
  • Siemens SIMATIC eaSie PCS 7 Skill Package
  • Siemens SIMATIC eaSie Workflow Skills
  • Siemens SIMATIC Energy Suite V17
  • Siemens SIMATIC Energy Suite V18
  • Siemens SIMATIC Energy Suite V19
  • Siemens SIMATIC Logon V1.6
  • Siemens SIMATIC Logon V2.0
  • Siemens SIMATIC Management Agent
  • Siemens SIMATIC Management Console
  • Siemens SIMATIC MTP CREATOR V2.x
  • Siemens SIMATIC MTP CREATOR V3.x
  • Siemens SIMATIC MTP CREATOR V4.x
  • Siemens SIMATIC MTP CREATOR V5.x
  • Siemens SIMATIC MTP Integrator V1.x
  • Siemens SIMATIC MTP Integrator V2.x
  • Siemens SIMATIC NET PC Software V16
  • Siemens SIMATIC NET PC Software V17
  • Siemens SIMATIC NET PC Software V18
  • Siemens SIMATIC NET PC Software V19
  • Siemens SIMATIC NET PC Software V20
  • Siemens SIMATIC ODK 1500S
  • Siemens SIMATIC PCS 7 Advanced Process Faceplates V9.1
  • Siemens SIMATIC PCS 7 Advanced Process Functions V2.1
  • Siemens SIMATIC PCS 7 Advanced Process Functions V2.2
  • Siemens SIMATIC PCS 7 Advanced Process Graphics V10.0
  • Siemens SIMATIC PCS 7 Advanced Process Graphics V9.1
  • Siemens SIMATIC PCS 7 Advanced Process Library incl. Faceplates V10.0

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.