Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Key facts for Siemens SIWA DLL hijacking

Detection coverage for Siemens SIWA DLL hijacking

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5480 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Siemens SIWA Installer Unsigned DLL Load From Own Directory (CVE-2025-30033) [SPL]

Flags a Siemens-style setup executable (SIWA / Online Software Delivery installer) running from a download, temp, public or UNC folder and loading an unsigned DLL from that same folder. This is the DLL search-order hijack (T1574.001, CWE-427) and side-load variant (T1574.002) described in SSA-282044 / CVE-2025-30033 and runs with the privileges of the installing user, typically an OT engineering workstation operator. Affected products include SIMATIC PCS 7, SIMATIC WinCC, TIA Portal and SINAMICS Startdrive.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.001, T1574, T1574.002, T1204.002
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 Signed=false ImageLoaded="*.dll"
| eval image_name=lower(mvindex(split(Image, "\\"), -1)), image_dir=lower(mvjoin(mvindex(split(Image, "\\"), 0, -2), "\\")), dll_dir=lower(mvjoin(mvindex(split(ImageLoaded, "\\"), 0, -2), "\\"))
| where image_dir=dll_dir AND match(image_name, "(setup|siwa|simatic|wincc|pcs7|startdrive|tiaportal|tia_portal|licens).*[.]exe$") AND match(image_dir, "downloads|appdata.local.temp|users.public|^[^a-z]")
| stats count min(_time) as first_seen max(_time) as last_seen dc(ImageLoaded) as unsigned_dll_count values(ImageLoaded) as unsigned_dlls values(Hashes) as hashes by host, User, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let TrustedDlls = DeviceFileCertificateInfo
    | where Timestamp > ago(24h)
    | where IsTrusted == 1
    | distinct SHA1;
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName endswith ".dll"
| where InitiatingProcessFileName matches regex @"(?i)(setup|siwa|simatic|wincc|pcs7|startdrive|tiaportal|tia_portal|licens).*[.]exe$"
| where InitiatingProcessFolderPath has "Downloads" or InitiatingProcessFolderPath has_all ("AppData", "Temp") or InitiatingProcessFolderPath has_all ("Users", "Public") or not(InitiatingProcessFolderPath matches regex @"^[A-Za-z]:")
| extend ProcDir = tolower(substring(InitiatingProcessFolderPath, 0, strlen(InitiatingProcessFolderPath) - strlen(InitiatingProcessFileName)))
| extend DllDir = tolower(substring(FolderPath, 0, strlen(FolderPath) - strlen(FileName)))
| where ProcDir == DllDir
| join kind=leftanti TrustedDlls on SHA1
| summarize LoadCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Dlls = make_set(FileName, 20), DllHashes = make_set(SHA1, 20) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ProcDir
| project DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ProcDir, LoadCount, Dlls, DllHashes, FirstSeen, LastSeen

Sigma

title: Siemens SIWA Installer Loads Unsigned DLL From User-Writable Directory (CVE-2025-30033)
id: 3f6a9c1e-2b4d-4c7a-8e15-9d0b7a6c5e11
status: experimental
description: Detects a Siemens-style setup executable (SIWA or Online Software Delivery installer) running from a download, temp, public or shared folder and loading an unsigned DLL. Sigma cannot compare the executable directory with the DLL directory, so confirm in the SIEM that both paths match (DLL search-order hijacking, CWE-427).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-282044.html
    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-22
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30033
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1574.001
    - attack.t1574.002
    - attack.t1574
    - attack.execution
    - attack.t1204.002
    - cve.2025-30033
logsource:
    category: image_load
    product: windows
detection:
    selection_process:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
        Image|re: '(?i)(setup|siwa|simatic|wincc|pcs7|startdrive|tiaportal|tia_portal|licens).*[.]exe$'
    selection_dll:
        ImageLoaded|endswith: '.dll'
        Signed: 'false'
    condition: all of selection_*
falsepositives:
    - Legitimate third-party installers run from the Downloads folder that load their own unsigned helper DLLs
    - Engineering staff unpacking Siemens installers together with unsigned in-house libraries
level: high

Known false positives:

• Third-party installers run from the Downloads folder that load their own unsigned helper DLLs
• Engineering teams unpacking Siemens installers alongside unsigned in-house libraries

Tuning notes: Restrict the image-name regex to the Siemens setup executables actually used in your estate and allowlist known vendor-signed installers. The Signed=false filter relies on Sysmon signature checking (EventCode 7 with SignatureVerified enabled); the KQL form relies on DeviceFileCertificateInfo coverage. Add engineering share paths used for Siemens media. Run in hunt mode over 30 days before alerting. T1574.002 is mapped because the vulnerable installer is a legitimate signed binary that loads the planted DLL.

• 🔒 Siemens Installer Loads System-Named DLL From Non-System Path (CVE-2025-30033) [KQL] · unlock with TL Creds
• 🔒 Siemens Installer Spawns Persistence Tooling (CVE-2025-30033) [KQL] · unlock with TL Creds
• 🔒 Siemens Installer Spawns Host Discovery Or Download Tools (CVE-2025-30033) [KQL] · unlock with TL Creds
• 🔒 Siemens Installer Executed From Browser Or Archive Folder (CVE-2025-30033) [Sigma] · unlock with TL Creds
• 🔒 Siemens Installer Writes Autorun, Service Or IFEO Registry Keys (CVE-2025-30033) [Sigma] · unlock with TL Creds
• 🔒 Siemens Installer Network Callout Or OT Protocol Connection (CVE-2025-30033) [Sigma] · unlock with TL Creds
• 🔒 Siemens Installer Directory DLL Staging Followed By Setup Execution (CVE-2025-30033) [SPL] · unlock with TL Creds
• 🔒 Siemens Installer Child LOLBin Or Non-Siemens Network Callout (CVE-2025-30033) [SPL] · unlock with TL Creds

Indicators of compromise for Siemens SIWA DLL hijacking

As of 2026-11-07, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5480.

How Siemens SIWA DLL hijacking works

Siemens ProductCERT advisory SSA-282044 (first published 2025-08-12, revised to v2.0 on 2026-10-13) describes a DLL hijacking vulnerability in the setup component of installers built with the Siemens Web Installer Application (SIWA), which is used by Siemens Online Software Delivery (OSD). The installer does not securely control the directories from which it loads DLLs (CWE-427). An attacker who can place a malicious DLL where the installer will find it can execute arbitrary code, with the privileges of the user running the installer, when a legitimate user installs an application that uses the affected component.

The flaw is rated CVSS v3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS v4.0 8.5. The attack vector is local and requires user interaction, so exploitation depends on the attacker first being able to write a DLL to the installer's working or download directory (for example a shared or untrusted download folder). CISA's ICS advisory ICSA-25-226-22 (released 2025-08-14) states that no known public exploitation targeting this vulnerability had been reported to CISA and that it is not remotely exploitable. NVD does not show it in CISA KEV, and no public PoC is cited in the sources reviewed. Tenable lists an EPSS score of 0.00224.

Affected products listed by Siemens include SIMATIC PCS 7 (V9.1, V10.0 and libraries), SIMATIC WinCC (V7.5, V8.0, V8.1 and runtime variants), SIMATIC Logon, SIMATIC Automation Tool, SIMATIC Management Console/Agent, SIMATIC NET PC Software, TIA Portal (V17-V20), TIA Administrator, TIA Project-Server, SINAMICS Startdrive, Automation License Manager, SINETPLAN, SINEC NMS, CEMAT, OpenPCS 7 and Process Historian variants. Fix status varies by product: some have fixed versions (for example SIMATIC PCS 7 V9.1 SP1 UC08), OpenPCS 7 and several V9.x/V10.0 libraries have no fix planned, and SIMATIC NET PC Software V16-V19 and other tools have no fix available yet. Counts of affected products differ between sources (over 100 to over 170); the Siemens advisory is authoritative.

Siemens credits Sahil Shah (National Forensic Sciences University) in the advisory; the CISA advisory states Siemens reported the issue internally. No threat actor, campaign or network IOCs are associated with this vulnerability. Defenders should treat it as an installer-integrity and local-hardening risk in ICS/OT engineering workstations.

MITRE ATT&CK techniques by tactic:

Execution

T1204.002 Malicious File

stealth

T1574 Hijack Execution Flow; T1574.001 DLL

Defense Evasion

T1574.001 DLL

Remediation for Siemens SIWA DLL hijacking

Patches

• Apply fixed versions where Siemens lists them (for example SIMATIC PCS 7 V9.1 SP1 UC08)
• No fix planned for OpenPCS 7 and several V9.x/V10.0 libraries; rely on workarounds

Immediate actions

• Install Siemens applications only from an empty directory so no malicious DLLs are present alongside the installer
• Harden application hosts to prevent local access by untrusted personnel
• Do not run SIWA/OSD-downloaded installers from shared, world-writable or browser download folders

Workarounds

• Use a clean empty directory for every installation
• Restrict local write access on engineering workstations

Longer-term hardening

• Follow Siemens operational guidelines for industrial security
• Apply defense-in-depth for ICS: network isolation, firewalls, VPN for remote access
• Monitor Siemens ProductCERT SSA-282044 for fixes on products with no fix yet

Affected and fixed versions

• Siemens — SIMATIC PCS 7
  Vulnerable versions: V9.1; V10.0 and libraries
  Fixed in: V9.1 SP1 UC08
• Siemens — SIMATIC WinCC
  Vulnerable versions: V7.5; V8.0; V8.1; Runtime variants
• Siemens — TIA Portal
  Vulnerable versions: V17; V18; V19; V20
• Siemens — SINAMICS Startdrive
  Vulnerable versions: V17-V20
• Siemens — SIMATIC NET PC Software
  Vulnerable versions: V16-V19
• Siemens — OpenPCS 7
  Vulnerable versions: all versions
• Siemens — Automation License Manager
  Vulnerable versions: V6.0

Timeline of Siemens SIWA DLL hijacking

• 2025-08-12 locked-ioc-8 publishes SSA-282044 (V1.0) and CVE-2025-30033 is published to NVD
• 2025-08-14 CISA releases ICS advisory ICSA-25-226-22; no known public exploitation reported to CISA, not remotely exploitable
• 2025-09-09 SSA-282044 V1.1: Sahil Shah added to acknowledgments; fix added for SIMATIC Energy Suite V19
• 2025-10-14 SSA-282044 V1.2: fixes added for MTP Creator V2.x, CFL V4.x and locked-ioc-10 Unified
• 2025-11-11 SSA-282044 V1.3: fixes added for PCS 7 Logic Matrix V9.1 and PCS 7 Advanced Process Library
• 2025-12-09 SSA-282044 V1.4: fixes added for TIA Project-Server and locked-ioc-14 Cloud Connector
• 2026-01-13 SSA-282044 V1.5: fixes added for WinCC Panel Image Setup and locked-ioc-10 Runtime
• 2026-02-10 SSA-282044 V1.6: remediation updated for SIMATIC ODK 1500S and SIMATIC S7-PLCSIM
• 2026-03-10 SSA-282044 V1.7: fixes added for SIMATIC Target and locked-ioc-10 V7.5 and V8.0
• 2026-08-11 SSA-282044 V1.8: fixes added for D7-SYS, Automation Tool and Automation Tool SDK
• 2026-09-08 SSA-282044 V1.9: fix versions added for locked-ioc-16 and locked-ioc-14 V18
• 2026-10-13 Siemens publishes SSA-282044 V2.0 (affected version of locked-ioc-6 updated to V6.3); NVD record last modified the same day

Sources cited for Siemens SIWA DLL hijacking

• Siemens Security Advisory SSA-282044 (v2.0) cert-portal.siemens.com · Advisory · 2025-08-12
• CISA ICS Advisory ICSA-25-226-22 CISA · Government advisory · 2025-08-14
• NVD CVE-2025-30033 NVD (NIST) · Advisory · 2025-08-12
• Tenable CVE-2025-30033 Tenable · Research · 2025-08-12
• OpenCVE CVE-2025-30033 app.opencve.io · Research · 2025-08-12
• Siemens Operational Guidelines for Industrial Security siemens.com · Vendor report · 2025-08-12
• Siemens ProductCERT advisories index siemens.com · Vendor report · 2025-08-12

More in vulnerability

• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)
• SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released