CVE record · CVE-2025-30033

Uncontrolled search path in Siemens Automation License Manager V6.0 and others

CVSS 8.5 HighEPSS 0.0022 · 13th percentile

Published by the CVE Program (CNA: siemens) at 12 Aug 2025, 11:16 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Siemens	Automation License Manager V6.0	affected before * custom Other versions: unknown
Siemens	Automation License Manager V6.2	affected before V6.2 Upd3 custom Other versions: unknown
Siemens	CEMAT V10.0	affected before * custom Other versions: unknown
Siemens	CP PtP Param configuring interface	affected before * custom Other versions: unknown
Siemens	Create MyConfig (CMC)	affected before V6.9 custom Other versions: unknown
Siemens	Energy Support Library (EnSL)	affected before * custom Other versions: unknown
Siemens	FM Configuration Package	affected before * custom Other versions: unknown
Siemens	Modular PID CTRL Tool	affected before * custom Other versions: unknown
Siemens	MultiFieldbus Configuration Tool (MFCT)	affected before V1.5.5.0 custom Other versions: unknown
Siemens	OpenPCS 7 V10.0	affected before * custom Other versions: unknown
Siemens	OpenPCS 7 V9.1	affected before * custom Other versions: unknown
Siemens	Siemens Network Planner (SINETPLAN)	affected before V2.0 SP2 custom Other versions: unknown
Siemens	SIMATIC Automation Tool	affected before V5.0 SP4 custom Other versions: unknown
Siemens	SIMATIC Automation Tool SDK Windows	affected before V5.0 SP4 custom Other versions: unknown
Siemens	SIMATIC BATCH V10.0	affected before * custom Other versions: unknown
Siemens	SIMATIC BATCH V9.1	affected before * custom Other versions: unknown
Siemens	SIMATIC Control Function Library (CFL) V1.x	affected before * custom Other versions: unknown
Siemens	SIMATIC Control Function Library (CFL) V2.x	affected before * custom Other versions: unknown
Siemens	SIMATIC Control Function Library (CFL) V3.x	affected before V3.1.0.2 custom Other versions: unknown
Siemens	SIMATIC Control Function Library (CFL) V4.x	affected before V4.1 custom Other versions: unknown
Siemens	SIMATIC D7-SYS	affected before V10.0 SP1 custom Other versions: unknown
Siemens	SIMATIC eaSie Core Package	affected before * custom Other versions: unknown
Siemens	SIMATIC eaSie Document Skills	affected before * custom Other versions: unknown
Siemens	SIMATIC eaSie PCS 7 Skill Package	affected before * custom Other versions: unknown
Siemens	SIMATIC eaSie Workflow Skills	affected before * custom Other versions: unknown
Siemens	SIMATIC Energy Suite V17	affected before * custom Other versions: unknown
Siemens	SIMATIC Energy Suite V18	affected before * custom Other versions: unknown
Siemens	SIMATIC Energy Suite V19	affected before V19 Update 4 custom Other versions: unknown
Siemens	SIMATIC Logon V1.6	affected before * custom Other versions: unknown
Siemens	SIMATIC Logon V2.0	affected before V2.0 Upd3 custom Other versions: unknown
Siemens	SIMATIC Management Agent	affected before V9.1 SP1 Upd8 custom Other versions: unknown
Siemens	SIMATIC Management Console	affected before V9.1 SP1 Upd8 custom Other versions: unknown
Siemens	SIMATIC MTP CREATOR V2.x	affected before V2.1 custom Other versions: unknown
Siemens	SIMATIC MTP CREATOR V3.x	affected before * custom Other versions: unknown
Siemens	SIMATIC MTP CREATOR V4.x	affected before V4.1.0.1 custom Other versions: unknown
Siemens	SIMATIC MTP CREATOR V5.x	affected before V5.0.0.1 custom Other versions: unknown
Siemens	SIMATIC MTP Integrator V1.x	affected before * custom Other versions: unknown
Siemens	SIMATIC MTP Integrator V2.x	affected before * custom Other versions: unknown
Siemens	SIMATIC NET PC Software V16	affected before * custom Other versions: unknown
Siemens	SIMATIC NET PC Software V17	affected before * custom Other versions: unknown

And 99 more products. The full list is on the CVE record.

Identifiers: CVE-2025-30033
CNA: siemens
Weakness (CWE): CWE-427
Tags: Siemens Automation License Manager V6.0
Siemens Automation License Manager V6.2
Siemens CEMAT V10.0
Siemens CP PtP Param configuring interface
Siemens Create MyConfig (CMC)
Siemens Energy Support Library (EnSL)
Siemens FM Configuration Package
Siemens Modular PID CTRL Tool
CWE-427
Published: 12 Aug 2025
Updated: 13 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.8	High	3.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CNA (siemens)
8.5	High	4.0	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CNA (siemens)Used for this record

CISA KEV Not listed.
EPSS 0.0022, the 13th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 12 Aug 2025. New records show when each source confirmed them.

Sources

References from the CNA

cert-portal.siemens.com/productcert/html/ssa-282044.html

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.