Introduction
A recently disclosed vulnerability in Siemens SIMATIC STEP 7, WinCC, and related engineering platforms could let an attacker execute arbitrary code through a malicious project file. Attackers could use it to compromise engineering workstations or automation controllers, which makes it a serious concern for organizations in manufacturing and critical infrastructure.
About Siemens and Its Industrial Automation Portfolio: Siemens is a global leader in industrial automation and digitalization. Its portfolio spans programmable logic controllers, HMI systems, engineering tools, and cloud-based industrial platforms. Siemens products are widely deployed in critical infrastructure, manufacturing, energy, and transportation, so the security of its software matters internationally.
Technical Information
CVE-2025-40759 is classified as CWE-502 (Deserialization of Untrusted Data). Affected Siemens products do not properly sanitize stored security properties when they parse project files. If a vulnerable application loads a crafted project file containing malicious serialized objects, deserialization can cause type confusion. An attacker can then instantiate objects of unexpected types, which may lead to arbitrary code execution in the context of the application's process.
Exploitation happens when a malicious project file is opened or imported. The file could arrive on removable media, over a network share, or through any other file transfer method common in industrial environments. Both on-premises and cloud-based deployments are affected. The risk is greatest where systems regularly exchange project files or import them from external sources. No public exploit code or vulnerable code snippets are available at this time.
Affected Systems and Versions
CVE-2025-40759 affects the following Siemens products and versions:
- SIMATIC S7-PLCSIM V17 (all versions)
- SIMATIC STEP 7 V17 (all versions)
- SIMATIC STEP 7 V18 (all versions)
- SIMATIC STEP 7 V19 (all versions prior to V19 Update 4)
- SIMATIC STEP 7 V20 (all versions)
- SIMATIC WinCC V17 (all versions)
- SIMATIC WinCC V18 (all versions)
- SIMATIC WinCC V19 (all versions prior to V19 Update 4)
- SIMATIC WinCC V20 (all versions)
- SIMOCODE ES V17 (all versions)
- SIMOCODE ES V18 (all versions)
- SIMOCODE ES V19 (all versions)
- SIMOCODE ES V20 (all versions)
- SIMOTION SCOUT TIA V5.4 (all versions)
- SIMOTION SCOUT TIA V5.5 (all versions)
- SIMOTION SCOUT TIA V5.6 (all versions prior to V5.6 SP1 HF7)
- SIMOTION SCOUT TIA V5.7 (all versions)
- SINAMICS Startdrive V17 (all versions)
- SINAMICS Startdrive V18 (all versions)
- SINAMICS Startdrive V19 (all versions)
- SINAMICS Startdrive V20 (all versions)
- SIRIUS Safety ES V17 (TIA Portal) (all versions)
- SIRIUS Safety ES V18 (TIA Portal) (all versions)
- SIRIUS Safety ES V19 (TIA Portal) (all versions)
- SIRIUS Safety ES V20 (TIA Portal) (all versions)
- SIRIUS Soft Starter ES V17 (TIA Portal) (all versions)
- SIRIUS Soft Starter ES V18 (TIA Portal) (all versions)
- SIRIUS Soft Starter ES V19 (TIA Portal) (all versions)
- SIRIUS Soft Starter ES V20 (TIA Portal) (all versions)
- TIA Portal Cloud V17 (all versions)
- TIA Portal Cloud V18 (all versions)
- TIA Portal Cloud V19 (all versions prior to V5.2.1.1)
- TIA Portal Cloud V20 (all versions)
Vendor Security History
Siemens has addressed similar deserialization vulnerabilities in its engineering software before. CVE-2022-45147, for example, affected SIMATIC STEP 7 and related products and allowed type confusion and arbitrary code execution through crafted project files. Siemens usually publishes detailed advisories and mitigation guidance, but it has shifted some of the responsibility for ongoing monitoring and patching to end users, especially for legacy systems. Deserialization and type confusion bugs keep recurring, which points to ongoing problems in how Siemens develops and validates its industrial software.
