# Uncontrolled search path in Siemens Automation License Manager V6.0 and others CVE record · `CVE-2025-30033` - **Identifiers:** `CVE-2025-30033` - **State:** Confirmed - **Severity:** CVSS 8.5 High - **Critical:** No - **CNA:** siemens - **Weakness (CWE):** [CWE-427](https://cwe.mitre.org/data/definitions/427.html) - **Tags:** [CWE-427](https://agentprime.io/advisories/tag/cwe-427.md) - **Technologies:** [Siemens Automation License Manager V6.0](https://agentprime.io/advisories/technology/siemens-automation-license-manager-v6-0.md) · [Siemens Automation License Manager V6.2](https://agentprime.io/advisories/technology/siemens-automation-license-manager-v6-2.md) · [Siemens CEMAT V10.0](https://agentprime.io/advisories/technology/siemens-cemat-v10-0.md) · [Siemens CP PtP Param configuring interface](https://agentprime.io/advisories/technology/siemens-cp-ptp-param-configuring-interface.md) · [Siemens Create MyConfig (CMC)](https://agentprime.io/advisories/technology/siemens-create-myconfig-cmc.md) · [Siemens Energy Support Library (EnSL)](https://agentprime.io/advisories/technology/siemens-energy-support-library-ensl.md) · [Siemens FM Configuration Package](https://agentprime.io/advisories/technology/siemens-fm-configuration-package.md) · [Siemens Modular PID CTRL Tool](https://agentprime.io/advisories/technology/siemens-modular-pid-ctrl-tool.md) · [Siemens MultiFieldbus Configuration Tool (MFCT)](https://agentprime.io/advisories/technology/siemens-multifieldbus-configuration-tool-mfct.md) · [Siemens OpenPCS 7 V10.0](https://agentprime.io/advisories/technology/siemens-openpcs-7-v10-0.md) · [Siemens OpenPCS 7 V9.1](https://agentprime.io/advisories/technology/siemens-openpcs-7-v9-1.md) · [Siemens Network Planner (SINETPLAN)](https://agentprime.io/advisories/technology/siemens-network-planner-sinetplan.md) · [Siemens SIMATIC Automation Tool](https://agentprime.io/advisories/technology/siemens-simatic-automation-tool.md) · [Siemens SIMATIC Automation Tool SDK Windows](https://agentprime.io/advisories/technology/siemens-simatic-automation-tool-sdk-windows.md) · [Siemens SIMATIC BATCH V10.0](https://agentprime.io/advisories/technology/siemens-simatic-batch-v10-0.md) · [Siemens SIMATIC BATCH V9.1](https://agentprime.io/advisories/technology/siemens-simatic-batch-v9-1.md) · [Siemens SIMATIC Control Function Library (CFL) V1.x](https://agentprime.io/advisories/technology/siemens-simatic-control-function-library-cfl-v1-x.md) · [Siemens SIMATIC Control Function Library (CFL) V2.x](https://agentprime.io/advisories/technology/siemens-simatic-control-function-library-cfl-v2-x.md) · [Siemens SIMATIC Control Function Library (CFL) V3.x](https://agentprime.io/advisories/technology/siemens-simatic-control-function-library-cfl-v3-x.md) · [Siemens SIMATIC Control Function Library (CFL) V4.x](https://agentprime.io/advisories/technology/siemens-simatic-control-function-library-cfl-v4-x.md) - **Published:** 12 Aug 2025 - **Updated:** 13 Oct 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: siemens) at 12 Aug 2025, 11:16 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Siemens. Product: Automation License Manager V6.0. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: Automation License Manager V6.2. - affected: `before V6.2 Upd3` (custom) - Other versions: unknown - Vendor: Siemens. Product: CEMAT V10.0. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: CP PtP Param configuring interface. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: Create MyConfig (CMC). - affected: `before V6.9` (custom) - Other versions: unknown - Vendor: Siemens. Product: Energy Support Library (EnSL). - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: FM Configuration Package. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: Modular PID CTRL Tool. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: MultiFieldbus Configuration Tool (MFCT). - affected: `before V1.5.5.0` (custom) - Other versions: unknown - Vendor: Siemens. Product: OpenPCS 7 V10.0. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: OpenPCS 7 V9.1. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: Siemens Network Planner (SINETPLAN). - affected: `before V2.0 SP2` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Automation Tool. - affected: `before V5.0 SP4` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Automation Tool SDK Windows. - affected: `before V5.0 SP4` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC BATCH V10.0. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC BATCH V9.1. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Control Function Library (CFL) V1.x. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Control Function Library (CFL) V2.x. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Control Function Library (CFL) V3.x. - affected: `before V3.1.0.2` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Control Function Library (CFL) V4.x. - affected: `before V4.1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC D7-SYS. - affected: `before V10.0 SP1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC eaSie Core Package. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC eaSie Document Skills. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC eaSie PCS 7 Skill Package. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC eaSie Workflow Skills. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Energy Suite V17. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Energy Suite V18. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Energy Suite V19. - affected: `before V19 Update 4` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Logon V1.6. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Logon V2.0. - affected: `before V2.0 Upd3` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Management Agent. - affected: `before V9.1 SP1 Upd8` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC Management Console. - affected: `before V9.1 SP1 Upd8` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC MTP CREATOR V2.x. - affected: `before V2.1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC MTP CREATOR V3.x. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC MTP CREATOR V4.x. - affected: `before V4.1.0.1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC MTP CREATOR V5.x. - affected: `before V5.0.0.1` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC MTP Integrator V1.x. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC MTP Integrator V2.x. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC NET PC Software V16. - affected: `before *` (custom) - Other versions: unknown - Vendor: Siemens. Product: SIMATIC NET PC Software V17. - affected: `before *` (custom) - Other versions: unknown And 99 more products. The full list is on the CVE record: ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, from CNA (siemens) - 8.5 High, CVSS 4.0: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`, from CNA (siemens) (used for this record) - **CISA KEV:** Not listed. - **EPSS:** 0.0022, the 13th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 12 Aug 2025. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2025-30033](https://www.cve.org/CVERecord?id=CVE-2025-30033) - [NVD: CVE-2025-30033](https://nvd.nist.gov/vuln/detail/CVE-2025-30033) ### References from the CNA - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .