CVE-2025-27127

MEDIUM

TIA Project-Server <V2.1.1, TIA Portal <V19.4, TIA Portal <V20.3 - ...

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.

References (1)

Core 1

Scores

CVSS v3 4.3
EPSS 0.0010
EPSS Percentile 26.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-434
Status published
Products (6)
Siemens/TIA Project-Server < V2.1.1
Siemens/TIA Project-Server V17
Siemens/Totally Integrated Automation Portal (TIA Portal) V17
Siemens/Totally Integrated Automation Portal (TIA Portal) V18
Siemens/Totally Integrated Automation Portal (TIA Portal) V19 < V19 Update 4
Siemens/Totally Integrated Automation Portal (TIA Portal) V20 < V20 Update 3
Published Jul 08, 2025
Tracked Since Feb 18, 2026