{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reported this vulnerability to CISA." }, { "names": [ "Sahil Shah" ], "organization": "National Forensic Sciences University", "summary": "reported this vulnerability to Siemens." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage" } }, "lang": "en", "notes": [ { "category": "summary", "text": "The installers used to install several Siemens products are affected by a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected installer component. This vulnerability poses a risk only during setup and installation phase of the affected applications downloaded e.g. via OSD (Online Software Delivery).\n\nSiemens has released new versions for several affected products and recommends using the latest versions during setup and installation. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).", "title": "Legal Notice and Terms of Use" }, { "category": "other", "text": "This ICSA is a verbatim republication of Siemens ProductCERT SSA-282044 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Critical Manufacturing, Energy", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-282044.json" }, { "category": "self", "summary": "SSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-282044.html" }, { "category": "self", "summary": "ICS Advisory ICSA-25-226-22 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-22.json" }, { "category": "self", "summary": "ICS Advisory ICSA-25-226-22 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-22" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b" } ], "title": "Siemens Web Installer", "tracking": { "current_release_date": "2026-03-12T06:00:00.000000Z", "generator": { "date": "2026-03-11T21:23:49.638741Z", "engine": { "name": "CISA CSAF Generator", "version": "1.5.0" } }, "id": "ICSA-25-226-22", "initial_release_date": "2025-08-12T00:00:00.000000Z", "revision_history": [ { "date": "2025-08-12T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "Publication Date" }, { "date": "2025-09-09T00:00:00.000000Z", "legacy_version": "Additional Release 1", "number": "2", "summary": "Added Sahil Shah to acknowledgment; Added fix for SIMATIC Energy Suite V19, SIMATIC Energy Suite V20, SIMATIC MTP CREATOR V4.x, SIMATIC Control Function Library (CFL) V3.x, TIA Portal Test Suite V19, TIA Portal Test Suite V20, SIMATIC WinCC Visualization Architect V19, SIMATIC WinCC Visualization Architect V20, SIMATIC S7-PCT; Updated No fix planned for SIMATIC ProSave V17,SIMATIC WinCC flexible ES, SIMATIC Control Function Library (CFL) V1.x, SIMATIC Control Function Library (CFL) V2.x" }, { "date": "2025-10-14T00:00:00.000000Z", "legacy_version": "Additional Release 2", "number": "3", "summary": "Added fix for MTP Creator V2.x, CFL V4.x, Simatic WinCC Unified Line Coordination and Simatic WinCC Unified Sequence" }, { "date": "2025-11-11T00:00:00.000000Z", "legacy_version": "Additional Release 3", "number": "4", "summary": "Added Fixes for PCS 7 Logic Matrix V9.1, PCS7 Advanced Process Faceplates V9.1, SIMATIC PCS 7 Basis Faceplates V9.1 PCS 7 Basis Library V9.1, SIMATIC Management Agent V9.1, SIMATIC Management Console V9.1, PCS 7 V9.1, PCS 7 V10.0" }, { "date": "2025-12-09T00:00:00.000000Z", "legacy_version": "Additional Release 4", "number": "5", "summary": "Added fixes for TIA Project-Server, TIA Portal Cloud Connector, SIMATIC MTP CREATOR V5.x, SIMATIC S7-1500 Software Controller V3, Simatic Prosave, TIA Portal V20, V19, and V17 and updated Energy suite V17 and V18, SIMATIC S7-1500 Software Controller V2 with no fix planned" }, { "date": "2026-01-13T00:00:00.000000Z", "legacy_version": "Additional Release 5", "number": "6", "summary": "Added fixes for WinCC Panel Image Setup, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC Visualization Architect (SiVArc) V17, SIMATIC Process Historian 2024, SIMATIC PCS 7 Basis Library V10.0, SIMATIC Logon V2.0, SIMATIC PDM V9.3, and MultiFieldbus Configuration Tool (MFCT); Clarified that no fix is planned for TIA Project-Server V17" }, { "date": "2026-01-14T22:05:40.684375Z", "legacy_version": "Additional Release 6", "number": "7", "summary": "CISA Republication - Initial Republication of Siemens ProductCERT SSA-282044 advisory" }, { "date": "2026-02-10T00:00:00.000000Z", "legacy_version": "Additional Release 7", "number": "8", "summary": "CISA Republication - Updated remediation for SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)" }, { "date": "2026-02-10T00:00:00.000000Z", "legacy_version": "Additional Release 8", "number": "9", "summary": "Updated remediation for SIMATIC ODK 1500S and SIMATIC S7-PLCSIM V17, V18, V19 to 'No fix planned' and added fix version for Create MyConfig (CMC)" }, { "date": "2026-02-12T07:00:00.000000Z", "legacy_version": "Additional Release 9", "number": "10", "summary": "CISA Republication update based on Siemens ProductCERT SSA-282044 advisory" }, { "date": "2026-03-10T00:00:00.000000Z", "legacy_version": "Additional Release 10", "number": "11", "summary": "Added fixes for Simatic Target, Simatic Wincc V7.5 and V8.0" }, { "date": "2026-03-12T06:00:00.000000Z", "legacy_version": "Latest Updated CISA Republication", "number": "12", "summary": "CISA Republication update based on Siemens ProductCERT SSA-282044 advisory" } ], "status": "final", "version": "12" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Automation License Manager V6.0", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Automation License Manager V6.0" }, { "branches": [ { "category": "product_version_range", "name": "