Skip to content
Fencer Vulns
high 7.8

CVE-2025-40759 json

A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP…

published 2025-08-12 14 mo ago modified 2026-10-13 27 d ago also EUVD-2025-24240

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions < V18 Update 6), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions < V17 Update 9), SIMATIC WinCC V18 (All versions < V18 Update 6), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions < V20 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions < V5.2.2.2). Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

Patch / fix

  • Siemens SIMATIC STEP 7 V17 V17 Update 9
  • Siemens SIMATIC STEP 7 V18 V18 Update 6
  • Siemens SIMATIC STEP 7 V19 V19 Update 4
  • Siemens SIMATIC STEP 7 V20 V20 Update 4
  • Siemens SIMATIC WinCC V17 V17 Update 9
  • Siemens SIMATIC WinCC V18 V18 Update 6
  • Siemens SIMATIC WinCC V19 V19 Update 4
  • Siemens SIMATIC WinCC V20 V20 Update 4
  • Siemens SIMOTION SCOUT TIA V5.6 V5.6 SP1 HF7
  • Siemens TIA Portal Cloud V19 V5.2.1.1
  • Siemens TIA Portal Cloud V20 V5.2.2.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-226-11 updated cvss 7.8

Siemens SIMATIC S7-PLCSIM

  • Siemens SIMATIC S7-PLCSIM V17
    affected: mitigation, no fix planned
  • Siemens SIMATIC STEP 7 V17 <V17_Update_9
    affected: fixed in V17, mitigation support.industry.siemens.com
  • Siemens SIMATIC STEP 7 V18
    affected: mitigation, no fix available
  • Siemens SIMATIC STEP 7 V19 <V19_Update_4
    affected: fixed in V19, mitigation support.industry.siemens.com
  • Siemens SIMATIC STEP 7 V20 <V20_Update_4
    affected: fixed in V20, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC V17 <V17_Update_9
    affected: fixed in V17, mitigation support.industry.siemens.com
  • Siemens SIMATIC WinCC V18
    affected: mitigation, no fix available
  • Siemens SIMATIC WinCC V19 <V19_Update_4
    affected: fixed in V19, mitigation support.industry.siemens.com
show 5 more
  • Siemens SIMATIC WinCC V20 <V20_Update_4
    affected: fixed in V20, mitigation support.industry.siemens.com
  • Siemens SIMOCODE ES V17 Siemens SIMOCODE ES V18 Siemens SIMOCODE ES V19 Siemens SIMOCODE ES V20 Siemens SIMOTION SCOUT TIA V5.4 Siemens SIMOTION SCOUT TIA V5.5
    affected: mitigation, no fix available
  • Siemens SIMOTION SCOUT TIA V5.6 <V5.6_SP1_HF7
    affected: fixed in V5.6, mitigation support.industry.siemens.com
  • Siemens SIMOTION SCOUT TIA V5.7 Siemens SINAMICS Startdrive V17 Siemens SINAMICS Startdrive V18 Siemens SINAMICS Startdrive V19 Siemens SINAMICS Startdrive V20 Siemens SIRIUS Safety ES V17 (TIA Portal)
    +9 more products
    Siemens SIRIUS Safety ES V18 (TIA Portal) Siemens SIRIUS Safety ES V19 (TIA Portal) Siemens SIRIUS Safety ES V20 (TIA Portal) Siemens SIRIUS Soft Starter ES V17 (TIA Portal) Siemens SIRIUS Soft Starter ES V18 (TIA Portal) Siemens SIRIUS Soft Starter ES V19 (TIA Portal) Siemens SIRIUS Soft Starter ES V20 (TIA Portal) Siemens TIA Portal Cloud V17 Siemens TIA Portal Cloud V18
    affected: mitigation, no fix available
  • Siemens TIA Portal Cloud V19 < 5.2.1.1 Siemens TIA Portal Cloud V20 < 5.2.2.2
    affected: vendor fix, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
14 mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Siemens SIMATIC S7-PLCSIM V17
  • Siemens SIMATIC STEP 7 V17
  • Siemens SIMATIC STEP 7 V18
  • Siemens SIMATIC STEP 7 V19
  • Siemens SIMATIC STEP 7 V20
  • Siemens SIMATIC WinCC V17
  • Siemens SIMATIC WinCC V18
  • Siemens SIMATIC WinCC V19
  • Siemens SIMATIC WinCC V20
  • Siemens SIMOCODE ES V17
  • Siemens SIMOCODE ES V18
  • Siemens SIMOCODE ES V19
  • Siemens SIMOCODE ES V20
  • Siemens SIMOTION SCOUT TIA V5.4
  • Siemens SIMOTION SCOUT TIA V5.5
  • Siemens SIMOTION SCOUT TIA V5.6
  • Siemens SIMOTION SCOUT TIA V5.7
  • Siemens SINAMICS Startdrive V17
  • Siemens SINAMICS Startdrive V18
  • Siemens SINAMICS Startdrive V19
  • Siemens SINAMICS Startdrive V20
  • Siemens SIRIUS Safety ES V17 (TIA Portal)
  • Siemens SIRIUS Safety ES V18 (TIA Portal)
  • Siemens SIRIUS Safety ES V19 (TIA Portal)
  • Siemens SIRIUS Safety ES V20 (TIA Portal)
  • Siemens SIRIUS Soft Starter ES V17 (TIA Portal)
  • Siemens SIRIUS Soft Starter ES V18 (TIA Portal)
  • Siemens SIRIUS Soft Starter ES V19 (TIA Portal)
  • Siemens SIRIUS Soft Starter ES V20 (TIA Portal)
  • Siemens TIA Portal Cloud V17
  • Siemens TIA Portal Cloud V18
  • Siemens TIA Portal Cloud V19
  • Siemens TIA Portal Cloud V20

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.