Siemens SIMOTION Tools privilege escalation via NSIS flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Local privilege escalation in Siemens SIMOTION installation tools allows attackers to gain SYSTEM privileges; no patch available.
Siemens SIMOTION Tools and related products contain an improper input validation vulnerability in the Nullsoft Scriptable Install System (NSIS) installer framework. The flaw allows local attackers to execute arbitrary code with SYSTEM privileges by exploiting a race condition in the temporary plugins directory creation during installation. Affected products include SIMATIC Technology Package TPCamGen, SIMOTION OA MIIF, SIMOTION OACAMGEN, SIMOTION OALECO, and SIMOTION OAVIBX, with all versions vulnerable.
Successful exploitation requires local access and occurs when a legitimate user installs an application using the affected setup component. The attacker must win a race condition to place a crafted executable in the temporary directory before the installer validates it. CVSS score is 8.1, reflecting high impact but requiring local access and high attack complexity. No public exploitation has been reported, and the vulnerability is not remotely exploitable.
Siemens has not released patches. Mitigations include ensuring no other users are logged in during installation and isolating control system networks from internet access. Organizations should implement defense-in-depth strategies and monitor for suspicious installer activity, though the high attack complexity and local-only requirement limit exposure in properly secured environments.
Mentioned in this report
Detection guidance
SYSTEM-Level Process Launched From NSIS Temporary Plugin Directory
Detects an executable running as SYSTEM from an NSIS nsX.tmp temporary directory, the end state of the NSIS plugin-directory race condition where an attacker-planted binary is executed by an elevated installer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SYSTEM-Level Process Launched From NSIS Temporary Plugin Directory
description: Detects an executable running as SYSTEM from an NSIS-style nsX.tmp temporary
directory. In the NSIS plugin-directory race condition an attacker places a crafted
binary in the temp directory before the elevated installer uses it, giving code
execution with SYSTEM privileges. Matches the directory pattern and integrity context,
not any specific product name.
tags:
- attack.privilege-escalation
- attack.t1548.004
logsource:
category: process_creation
product: windows
detection:
selection:
User|contains:
- SYSTEM
- "SYST\xC8ME"
Image|re: \\ns[a-z0-9]{1,8}\.tmp\\[^\\]+\.exe$
condition: selection
falsepositives:
- Legitimate NSIS installers deployed via SCCM or other software deployment run as
SYSTEM and may launch helper executables (for example redistributable installers)
from their nsX.tmp directory
level: medium
id: c795f37c-afd2-5324-b4be-db4d1760da70
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
SYSTEM Process Loading DLL From NSIS Temporary Plugin Directory
Detects a SYSTEM process loading a DLL from an NSIS nsX.tmp directory, which could be a planted DLL that wins the plugin-directory race. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SYSTEM Process Loading DLL From NSIS Temporary Plugin Directory
description: Detects a process running as SYSTEM loading a DLL from an NSIS-style
nsX.tmp temporary directory under a Temp path. Exploitation of the NSIS plugin-directory
race condition causes the elevated installer to load an attacker-supplied plugin
DLL. Needs tuning against legitimate NSIS plugin loads (System.dll, nsExec.dll)
in managed deployments.
tags:
- attack.privilege-escalation
- attack.t1548.004
logsource:
category: image_load
product: windows
detection:
selection:
User|contains:
- SYSTEM
- "SYST\xC8ME"
ImageLoaded|re: \\temp\\ns[a-z0-9]{1,8}\.tmp\\[^\\]+\.dll$
condition: selection
falsepositives:
- SYSTEM-context deployment of legitimate NSIS installers, which load their own plugin
DLLs such as System.dll from the nsX.tmp directory
level: low
id: 31e9c52d-ba9a-5c43-a3b9-cbeba9cd8333
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
Executable or DLL Dropped Into NSIS Temporary Directory
Detects creation of PE files inside an NSIS nsX.tmp temp directory, including binaries planted by another process to win the race. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable or DLL Dropped Into NSIS Temporary Directory
description: Detects creation of .exe or .dll files in an NSIS-style nsX.tmp directory
under a Temp path. Attackers exploiting the NSIS plugin-directory race condition
write a crafted binary there, impersonating an installer plugin, before the elevated
installer validates the directory. Triage by checking whether the writing process
is the installer itself or an unrelated process.
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1548.004
- attack.t1036
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|re: \\temp\\ns[a-z0-9]{1,8}\.tmp\\[^\\]+\.(dll|exe)$
filter_system_dll:
TargetFilename|endswith:
- \System.dll
- \nsExec.dll
condition: selection and not filter_system_dll
falsepositives:
- Legitimate NSIS installers extracting helper executables or plugin DLLs to their
temp directory during normal installation
level: low
id: 5189f0c7-86d3-5844-a749-6fcadbd9fb96
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs