Siemens TIA Portal and Project-Server Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in multiple versions of TIA Project-Server and TIA Portal. The issue arises from the applications improperly managing uploaded projects in the document root. This flaw could enable an attacker with contributor privileges to disrupt service by uploading a malicious project.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Remediation

Users of TIA Project-Server should update to version 2.1.1 or later. For TIA Project-Server V17, no fix is currently planned. General security recommendations include protecting network access to devices and following Siemens' operational guidelines for Industrial Security.