Siemens SIMATIC and SICAM Products Vulnerable to Trace-File Code Injection and Other Flaws

CISA published an ICS advisory warning that multiple Siemens SIMATIC controllers do not properly sanitize the contents of imported trace files, enabling code injection if an attacker can socially engineer a legitimate user into importing a specially crafted trace file. The affected product set includes a broad range of SIMATIC devices, including SIMATIC Drive Controller CPU 1504D/1507D TF, multiple SIMATIC ET 200SP CPU variants (including fail-safe models), and SIMATIC S7-1500 CPUs, among others.

CERT-FR also issued an advisory covering multiple vulnerabilities in Siemens products, listing impacts that include remote code execution, denial of service, and indirect code injection (XSS), and enumerating overlapping affected systems such as the same SIMATIC Drive Controller and SIMATIC ET 200SP families. CERT-FR explicitly references CVE-2025-40943 for several of these SIMATIC devices and additionally notes other Siemens components (e.g., SICAM SIAPP SDK versions prior to 2.1.7), indicating the Siemens security updates/mitigations span more than one product line and vulnerability class beyond the trace-file injection issue highlighted by CISA.