CVE-2025-30176

published 2025-05-13

CVE-2025-30176: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote…

high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote Connect (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions), Totally Integrated Automation Portal (TIA Portal) V20 (All versions), User Management Component (UMC) (All versions < V2.15.1.1). Affected products contain a out of bound read buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
siemens	simatic_pcs_neo	—	—
siemens	simatic_pcs_neo	—	—
siemens	simatic_pcs_neo_v4.1	< *	*
siemens	simatic_pcs_neo_v5.0	< *	*
siemens	sinec_nms	< V4.0	V4.0
siemens	sinec_nms	< 4.0	4.0
siemens	sinema_remote_connect	< *	*
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal_v17	< *	*
siemens	totally_integrated_automation_portal_v18	< *	*
siemens	totally_integrated_automation_portal_v19	< *	*
siemens	totally_integrated_automation_portal_v20	< *	*
siemens	user_management_component	< V2.15.1.1	V2.15.1.1
siemens	user_management_component	< 2.15.1.1	2.15.1.1

CWE-125