# Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

> A DLL hijacking flaw (CWE-427, Uncontrolled Search Path Element) in the Siemens Web Installer Application (SIWA) setup component allows arbitrary code execution when a legitimate user installs a Siemens product downloaded via Online Software Delivery. Well over 100 Siemens industrial products (SIMATIC, TIA Portal, SINAMICS Startdrive and others) are affected; some have fixes, others have none planned.

- **Published:** 2026-11-07T04:55:13Z
- **Last reviewed:** 2026-11-07T04:55:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5480
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5480.png
- **ID:** TL-2026-5480
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 17
- **CVEs:** CVE-2025-30033

## Description

Siemens ProductCERT advisory SSA-282044 (first published 2025-08-12, revised to v2.0 on 2026-10-13) describes a DLL hijacking vulnerability in the setup component of installers built with the Siemens Web Installer Application (SIWA), which is used by Siemens Online Software Delivery (OSD). The installer does not securely control the directories from which it loads DLLs (CWE-427). An attacker who can place a malicious DLL where the installer will find it can execute arbitrary code, with the privileges of the user running the installer, when a legitimate user installs an application that uses the affected component.

The flaw is rated CVSS v3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS v4.0 8.5. The attack vector is local and requires user interaction, so exploitation depends on the attacker first being able to write a DLL to the installer's working or download directory (for example a shared or untrusted download folder). CISA's ICS advisory ICSA-25-226-22 (released 2025-08-14) states that no known public exploitation targeting this vulnerability had been reported to CISA and that it is not remotely exploitable. NVD does not show it in CISA KEV, and no public PoC is cited in the sources reviewed. Tenable lists an EPSS score of 0.00224.

Affected products listed by Siemens include SIMATIC PCS 7 (V9.1, V10.0 and libraries), SIMATIC WinCC (V7.5, V8.0, V8.1 and runtime variants), SIMATIC Logon, SIMATIC Automation Tool, SIMATIC Management Console/Agent, SIMATIC NET PC Software, TIA Portal (V17-V20), TIA Administrator, TIA Project-Server, SINAMICS Startdrive, Automation License Manager, SINETPLAN, SINEC NMS, CEMAT, OpenPCS 7 and Process Historian variants. Fix status varies by product: some have fixed versions (for example SIMATIC PCS 7 V9.1 SP1 UC08), OpenPCS 7 and several V9.x/V10.0 libraries have no fix planned, and SIMATIC NET PC Software V16-V19 and other tools have no fix available yet. Counts of affected products differ between sources (over 100 to over 170); the Siemens advisory is authoritative.

Siemens credits Sahil Shah (National Forensic Sciences University) in the advisory; the CISA advisory states Siemens reported the issue internally. No threat actor, campaign or network IOCs are associated with this vulnerability. Defenders should treat it as an installer-integrity and local-hardening risk in ICS/OT engineering workstations.

## MITRE ATT&CK

- T1574.001 DLL
- T1574.001 DLL
- T1574.001 DLL
- T1574 Hijack Execution Flow
- T1204.002 Malicious File

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Siemens SIWA Installer Unsigned DLL Load From Own Directory (CVE-2025-30033) [SPL]** (`TL-2026-5480-SPL-001`)

Flags a Siemens-style setup executable (SIWA / Online Software Delivery installer) running from a download, temp, public or UNC folder and loading an unsigned DLL from that same folder. This is the DLL search-order hijack (T1574.001, CWE-427) and side-load variant (T1574.002) described in SSA-282044 / CVE-2025-30033 and runs with the privileges of the installing user, typically an OT engineering workstation operator. Affected products include SIMATIC PCS 7, SIMATIC WinCC, TIA Portal and SINAMICS Startdrive.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1574, T1574.002, T1204.002
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 Signed=false ImageLoaded="*.dll"
| eval image_name=lower(mvindex(split(Image, "\\"), -1)), image_dir=lower(mvjoin(mvindex(split(Image, "\\"), 0, -2), "\\")), dll_dir=lower(mvjoin(mvindex(split(ImageLoaded, "\\"), 0, -2), "\\"))
| where image_dir=dll_dir AND match(image_name, "(setup|siwa|simatic|wincc|pcs7|startdrive|tiaportal|tia_portal|licens).*[.]exe$") AND match(image_dir, "downloads|appdata.local.temp|users.public|^[^a-z]")
| stats count min(_time) as first_seen max(_time) as last_seen dc(ImageLoaded) as unsigned_dll_count values(ImageLoaded) as unsigned_dlls values(Hashes) as hashes by host, User, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let TrustedDlls = DeviceFileCertificateInfo
    | where Timestamp > ago(24h)
    | where IsTrusted == 1
    | distinct SHA1;
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName endswith ".dll"
| where InitiatingProcessFileName matches regex @"(?i)(setup|siwa|simatic|wincc|pcs7|startdrive|tiaportal|tia_portal|licens).*[.]exe$"
| where InitiatingProcessFolderPath has "Downloads" or InitiatingProcessFolderPath has_all ("AppData", "Temp") or InitiatingProcessFolderPath has_all ("Users", "Public") or not(InitiatingProcessFolderPath matches regex @"^[A-Za-z]:")
| extend ProcDir = tolower(substring(InitiatingProcessFolderPath, 0, strlen(InitiatingProcessFolderPath) - strlen(InitiatingProcessFileName)))
| extend DllDir = tolower(substring(FolderPath, 0, strlen(FolderPath) - strlen(FileName)))
| where ProcDir == DllDir
| join kind=leftanti TrustedDlls on SHA1
| summarize LoadCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Dlls = make_set(FileName, 20), DllHashes = make_set(SHA1, 20) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ProcDir
| project DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ProcDir, LoadCount, Dlls, DllHashes, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Siemens SIWA Installer Loads Unsigned DLL From User-Writable Directory (CVE-2025-30033)
id: 3f6a9c1e-2b4d-4c7a-8e15-9d0b7a6c5e11
status: experimental
description: Detects a Siemens-style setup executable (SIWA or Online Software Delivery installer) running from a download, temp, public or shared folder and loading an unsigned DLL. Sigma cannot compare the executable directory with the DLL directory, so confirm in the SIEM that both paths match (DLL search-order hijacking, CWE-427).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-282044.html
    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-22
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30033
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1574.001
    - attack.t1574.002
    - attack.t1574
    - attack.execution
    - attack.t1204.002
    - cve.2025-30033
logsource:
    category: image_load
    product: windows
detection:
    selection_process:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
        Image|re: '(?i)(setup|siwa|simatic|wincc|pcs7|startdrive|tiaportal|tia_portal|licens).*[.]exe$'
    selection_dll:
        ImageLoaded|endswith: '.dll'
        Signed: 'false'
    condition: all of selection_*
falsepositives:
    - Legitimate third-party installers run from the Downloads folder that load their own unsigned helper DLLs
    - Engineering staff unpacking Siemens installers together with unsigned in-house libraries
level: high
```

**Known false positives:**

- Third-party installers run from the Downloads folder that load their own unsigned helper DLLs
- Engineering teams unpacking Siemens installers alongside unsigned in-house libraries

**Tuning notes:** Restrict the image-name regex to the Siemens setup executables actually used in your estate and allowlist known vendor-signed installers. The Signed=false filter relies on Sysmon signature checking (EventCode 7 with SignatureVerified enabled); the KQL form relies on DeviceFileCertificateInfo coverage. Add engineering share paths used for Siemens media. Run in hunt mode over 30 days before alerting. T1574.002 is mapped because the vulnerable installer is a legitimate signed binary that loads the planted DLL.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Siemens Installer Loads System-Named DLL From Non-System Path (CVE-2025-30033) [KQL] (locked: unlock with TL Creds)
- Siemens Installer Spawns Persistence Tooling (CVE-2025-30033) [KQL] (locked: unlock with TL Creds)
- Siemens Installer Spawns Host Discovery Or Download Tools (CVE-2025-30033) [KQL] (locked: unlock with TL Creds)
- Siemens Installer Executed From Browser Or Archive Folder (CVE-2025-30033) [Sigma] (locked: unlock with TL Creds)
- Siemens Installer Writes Autorun, Service Or IFEO Registry Keys (CVE-2025-30033) [Sigma] (locked: unlock with TL Creds)
- Siemens Installer Network Callout Or OT Protocol Connection (CVE-2025-30033) [Sigma] (locked: unlock with TL Creds)
- Siemens Installer Directory DLL Staging Followed By Setup Execution (CVE-2025-30033) [SPL] (locked: unlock with TL Creds)
- Siemens Installer Child LOLBin Or Non-Siemens Network Callout (CVE-2025-30033) [SPL] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens Security Advisory SSA-282044 (v2.0)](https://cert-portal.siemens.com/productcert/html/ssa-282044.html)
- [CISA ICS Advisory ICSA-25-226-22](https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-22)
- [NVD CVE-2025-30033](https://nvd.nist.gov/vuln/detail/CVE-2025-30033)
- [Tenable CVE-2025-30033](https://www.tenable.com/cve/CVE-2025-30033)
- [OpenCVE CVE-2025-30033](https://app.opencve.io/cve/CVE-2025-30033)
- [Siemens Operational Guidelines for Industrial Security](https://www.siemens.com/cert/operational-guidelines-industrial-security)
- [Siemens ProductCERT advisories index](https://www.siemens.com/cert/advisories)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5480