Full Report
Siemens TIA Administrator before V3.0.6 contains multiple vulnerabilities which could allow an attacker to escalate privilege or exceute arbitrary code during installations. Siemens has released a new version for TIA Administrator and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Siemens TIA Administrator Allowing Privilege Escalation or Arbitrary Code Execution
## CVE Details
- CVE ID: CVE-2025-23364, CVE-2025-23365
- CVSS Score: 7.8 (Combined Highest) / CVSS v3.1: $\text{CVE-2025-23364 (6.2)}$, $\text{CVE-2025-23365 (7.8)}$
- CWE: CWE-347 (Improper Verification of Cryptographic Signature), CWE-284 (Improper Access Control)
## Affected Systems
- Products: Siemens TIA Administrator
- Versions: All versions before V3.0.6
- Configurations: Not explicitly detailed, but exploitation is related to installation processes.
## Vulnerability Description
The advisory covers two primary vulnerabilities:
1. **CVE-2025-23364 (Improper Certificate Validation):** The affected application improperly validates code signing certificates during installations. This flaw could be used by an attacker to bypass signature checks and execute arbitrary code during the installation process.
2. **CVE-2025-23365 (Improper Access Control):** Low-privileged users can trigger installations by overwriting cache files and modifying the downloads path. This allows a low-privileged attacker to escalate privileges and execute arbitrary code.
## Exploitation
- Status: PoC available (implied by E:P in CVSS vectors for both CVEs, indicating proof-of-concept code exists or is available)
- Complexity: Low (Based on attack vectors requiring local access and low complexity metrics in CVSS vectors)
- Attack Vector: Local (Both main vectors are $\text{AV:L}$)
## Impact
| Metric | CVE-2025-23364 (CVSS v3.1) | CVE-2025-23365 (CVSS v3.1) |
| :--- | :--- | :--- |
| Confidentiality | None ($\text{C:N}$) | High ($\text{C:H}$) |
| Integrity | High ($\text{I:H}$) | High ($\text{I:H}$) |
| Availability | None ($\text{A:N}$) | High ($\text{A:H}$) |
## Remediation
### Patches
- Update TIA Administrator to **Version V3.0.6 or later**.
- Vendor provided link for update: $\text{https://support.industry.siemens.com/cs/ww/en/view/109825038/}$ (defanged)
### Workarounds
- No specific technical workarounds listed other than applying general security recommendations.
- Apply general security measures recommended by Siemens.
## Detection
- Detection details were not explicitly provided in the summary, but standard file integrity monitoring (FIM) around installer directories and monitoring for unauthorized execution during installation phases are recommended.
## References
- Vendor Advisory: $\text{https://cert-portal.siemens.com/productcert/html/ssa-573669.html}$ (defanged)
- Siemens Industrial Security Guidelines: $\text{https://www.siemens.com/cert/operational-guidelines-industrial-security}$ (defanged)
- Siemens Industrial Security Portal: $\text{https://www.siemens.com/industrialsecurity}$ (defanged)