CVE-2025-40584: Siemens Simotion Scout Tia v5.4

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions < V5.7 HF2). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.

Affected products

• Siemens Simotion Scout Tia v5.4: any version
• Siemens Simotion Scout Tia v5.5: any version
• Siemens Simotion Scout Tia v5.6: before V5.6 SP1 HF7 (fixed in V5.6 SP1 HF7)
• Siemens Simotion Scout Tia v5.7: before V5.7 SP1 HF1 (fixed in V5.7 SP1 HF1)
• Siemens Simotion Scout v5.4: any version
• Siemens Simotion Scout v5.5: any version
• Siemens Simotion Scout v5.6: before V5.6 SP1 HF7 (fixed in V5.6 SP1 HF7)
• Siemens Simotion Scout v5.7: before V5.7 SP1 HF1 (fixed in V5.7 SP1 HF1)
• Siemens Sinamics Starter v5.5: any version
• Siemens Sinamics Starter v5.6: any version
• Siemens Sinamics Starter v5.7: before V5.7 HF2 (fixed in V5.7 HF2)

Published 2025-08-12. Last modified 2026-06-17.