IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms

HIGH
CVSS 7.8
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

Affected products do not properly sanitize user-controllable input when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2025-40759 7.8 high
CVE-2025-40759. Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

// Affected Products (21)

Vendor Product Asset Type Purdue Level Firmware
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown plc
L1
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown hmi
L2
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--
Siemens Unknown engineering_workstation
L3
--

// Remediations (19)

Patch: Update to V20 Update 4 or later version
Update to V20 Update 4 or later version
Patch: Fixed with V5.2.1.1, no user action required
Fixed with V5.2.1.1, no user action required
Patch: Update to V20 Update 4 or later version
Update to V20 Update 4 or later version
Patch: Update to V5.6 SP1 HF7 or later version
Update to V5.6 SP1 HF7 or later version
Patch: Fixed with V5.2.2.2, no user action required
Fixed with V5.2.2.2, no user action required
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Update to V18 Update 6 or later version
Update to V18 Update 6 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Mitigation: Only open projects from trusted sources.
Only open projects from trusted sources.
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V19 Update 4 or later version
Update to V19 Update 4 or later version
Patch: Update to V5.6 SP1 HF7 or later version
Update to V5.6 SP1 HF7 or later version
Mitigation: Only open projects from trusted sources.
Only open projects from trusted sources.
Patch: Update to V20 Update 4 or later version
Update to V20 Update 4 or later version
Patch: Update to V17 Update 9 or later version
Update to V17 Update 9 or later version
Patch: Fixed with V5.2.1.1, no user action required
Fixed with V5.2.1.1, no user action required
Patch: Fixed with V5.2.2.2, no user action required
Fixed with V5.2.2.2, no user action required

// References