Siemens SIMOTION SCOUT and SINAMICS STARTER XML External Entity Injection Vulnerability

A vulnerability allowing XML External Entity (XXE) injection has been identified in multiple versions of Siemens SIMOTION SCOUT TIA and SINAMICS STARTER applications. This vulnerability arises when the applications parse specially crafted XML files, potentially allowing an attacker to read arbitrary files from the system.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the system where the affected application is running.

Remediation

Siemens has released new versions for several affected products. For SIMOTION SCOUT and SINAMICS STARTER, it is recommended to update to the latest versions. For products where fixes are not yet available, Siemens advises not to open untrusted XML files in the affected applications.