CVE-2025-27127

State: Published
Severity: 5.3 Medium
Published: Jul 8, 2025
Updated: Aug 12, 2025
Reserved: Feb 19, 2025

Description

A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	siemens
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
TIA Project-ServerSiemens	before V2.1.1Affected
TIA Project-Server V17Siemens	all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V17Siemens	all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V18Siemens	all versionsAffected
Totally Integrated Automation Portal (TIA Portal) V19Siemens	before V19 Update 4Affected
Totally Integrated Automation Portal (TIA Portal) V20Siemens	before V20 Update 3Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-460466.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.