CVE-2025-30033High· 7.8▾ Twilight

The affected setup component is vulnerable to DLL hijacking

The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 12, 2025

Updated

Oct 13, 2026

CVSS

7.8

Vendor

Siemens

Product

Automation License Manager V6.0

CWE

CWE-427

Depth score

43 · Moderate

EPSS

0.21% · p11

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

decided 2025-08-12

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Aug 11.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 427 days

Aug 12, 2025Published
Disclosed via NVD
Aug 11, 2026EPSS first tracked
0.2%
Oct 9, 2026EPSS peak
0.2% → 0.2%
Oct 13, 2026Record revised
Last analysed / modified upstream

Siemens CWE-427 #nvd #cve.org

Affected

automation_license_manager_v6.0 < *
automation_license_manager_v6.2 < V6.2 Upd3
cemat_v10.0 < *
cp_ptp_param_configuring_interface < *
create_myconfig_cmc < V6.9
energy_support_library_ensl < *
fm_configuration_package < *
modular_pid_ctrl_tool < *
multifieldbus_configuration_tool_mfct < V1.5.5.0
openpcs_7_v10.0 < *
openpcs_7_v9.1 < *
network_planner_sinetplan < V2.0 SP2
simatic_automation_tool < V5.0 SP4
simatic_automation_tool_sdk_windows < V5.0 SP4
simatic_batch_v10.0 < *
simatic_batch_v9.1 < *
simatic_control_function_library_cfl_v1.x < *
simatic_control_function_library_cfl_v2.x < *
simatic_control_function_library_cfl_v3.x < V3.1.0.2
simatic_control_function_library_cfl_v4.x < V4.1
simatic_d7-sys < V10.0 SP1
simatic_easie_core_package < *
simatic_easie_document_skills < *
simatic_easie_pcs_7_skill_package < *
simatic_easie_workflow_skills < *
simatic_energy_suite_v17 < *
simatic_energy_suite_v18 < *
simatic_energy_suite_v19 < V19 Update 4
simatic_logon_v1.6 < *
simatic_logon_v2.0 < V2.0 Upd3
simatic_management_agent < V9.1 SP1 Upd8
simatic_management_console < V9.1 SP1 Upd8
simatic_mtp_creator_v2.x < V2.1
simatic_mtp_creator_v3.x < *
simatic_mtp_creator_v4.x < V4.1.0.1
simatic_mtp_creator_v5.x < V5.0.0.1
simatic_mtp_integrator_v1.x < *
simatic_mtp_integrator_v2.x < *
simatic_net_pc_software_v16 < *
simatic_net_pc_software_v17 < *
simatic_net_pc_software_v18 < *
simatic_net_pc_software_v19 < *
simatic_net_pc_software_v20 < V20.0 Update 1
simatic_odk_1500s < *
simatic_pcs_7_advanced_process_faceplates_v9.1 < V9.1 SP2 Upd4
simatic_pcs_7_advanced_process_functions_v2.1 < *
simatic_pcs_7_advanced_process_functions_v2.2 < *
simatic_pcs_7_advanced_process_graphics_v10.0 < *
simatic_pcs_7_advanced_process_graphics_v9.1 < *
simatic_pcs_7_advanced_process_library_incl._faceplates_v10.0 < *

Full technical detail▾

Overview

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://cert-portal.siemens.com/productcert/html/ssa-282044.html

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org