Siemens TIA Administrator prior 3.0.6 signature verification

Summaryinfo

A vulnerability identified as problematic has been detected in Siemens TIA Administrator. This affects an unknown part. The manipulation leads to signature verification. This vulnerability is uniquely identified as CVE-2025-23364. Local access is required to approach this attack. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Siemens TIA Administrator. This issue affects some unknown functionality. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is integrity. The summary by CVE is:

A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly validates code signing certificates. This could allow an attacker to bypass the check and exceute arbitrary code during installations.

The advisory is shared at cert-portal.siemens.com. The identification of this vulnerability is CVE-2025-23364 since 01/14/2025. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.0.6 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Siemens

Name

• TIA Administrator

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion