Siemens Tia Administrator vulnerabilities

CVE-2025-30033 [HIGH] CWE-427 CVE-2025-30033: The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.

CVE-2025-23365 [HIGH] CWE-284 CVE-2025-23365: A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected appli A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application allows low-privileged users to trigger installations by overwriting cache files and modifying the downloads path. This would allow an attacker to escalate privilege and exceute arbitrary code.

CVE-2025-23364 [MEDIUM] CWE-347 CVE-2025-23364: A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected appli A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly validates code signing certificates. This could allow an attacker to bypass the check and exceute arbitrary code during installations.

CVE-2024-45386 [HIGH] CWE-613 CVE-2024-45386: A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (Al A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19

CVE-2023-38533 [MEDIUM] CWE-379 CVE-2023-38533: A vulnerability has been identified in TIA Administrator (All versions < V3 SP2). The affected compo A vulnerability has been identified in TIA Administrator (All versions < V3 SP2). The affected component creates temporary download files in a directory with insecure permissions. This could allow any authenticated attacker on Windows to disrupt the update process.

CVE-2019-10915 [HIGH] CWE-306 CVE-2019-10915: A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integra A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access to the affected system. Successful exploitation req