# Siemens SIMATIC RTLS Locating Manager DoS and privilege escalation

Published: 2025-08-14 · Severity: routine · Sectors: manufacturing, transportation
Canonical: https://vorant.io/reports/a5ecc27b-e7f3-5d71-9d51-6913377601ca/siemens-simatic-rtls-locating-manager-dos-and-privilege-escalation

> Two local vulnerabilities in Siemens SIMATIC RTLS Locating Manager allow denial of service and credential theft; update to v3.3.

Siemens SIMATIC RTLS Locating Manager contains two local vulnerabilities affecting all versions prior to 3.3. CVE-2025-30034 is a reachable assertion (CWE-617) in input validation on the loopback listening port that allows an unauthenticated local attacker to cause denial of service with low attack complexity. CVE-2025-40751 is insufficient credential protection (CWE-522) in the Report Client component that allows an authenticated local attacker to extract credentials and escalate privileges from Manager role to System Administrator. Both vulnerabilities require local access and are not remotely exploitable. CVSS scores are 6.2 and 6.3 respectively, reflecting local-only attack surface but meaningful impact to availability and privilege escalation.

No public exploitation has been reported. The vulnerabilities affect critical manufacturing and transportation systems worldwide. Siemens has released version 3.3 as the remediation. CISA recommends updating to v3.3 or later, implementing network segmentation, firewall protections, and following Siemens industrial security guidelines.

## Mentioned in this report

- Vulnerabilities: CVE-2025-30034, CVE-2025-40751

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a5ecc27b-e7f3-5d71-9d51-6913377601ca/siemens-simatic-rtls-locating-manager-dos-and-privilege-escalation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup