# Siemens SIMOTION Tools privilege escalation via NSIS flaw

Published: 2025-09-11 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/b25930cc-80d4-5c44-b996-68398d4f5df7/siemens-simotion-tools-privilege-escalation-via-nsis-flaw

> Local privilege escalation in Siemens SIMOTION installation tools allows attackers to gain SYSTEM privileges; no patch available.

Siemens SIMOTION Tools and related products contain an improper input validation vulnerability in the Nullsoft Scriptable Install System (NSIS) installer framework. The flaw allows local attackers to execute arbitrary code with SYSTEM privileges by exploiting a race condition in the temporary plugins directory creation during installation. Affected products include SIMATIC Technology Package TPCamGen, SIMOTION OA MIIF, SIMOTION OACAMGEN, SIMOTION OALECO, and SIMOTION OAVIBX, with all versions vulnerable.

Successful exploitation requires local access and occurs when a legitimate user installs an application using the affected setup component. The attacker must win a race condition to place a crafted executable in the temporary directory before the installer validates it. CVSS score is 8.1, reflecting high impact but requiring local access and high attack complexity. No public exploitation has been reported, and the vulnerability is not remotely exploitable.

Siemens has not released patches. Mitigations include ensuring no other users are logged in during installation and isolating control system networks from internet access. Organizations should implement defense-in-depth strategies and monitor for suspicious installer activity, though the high attack complexity and local-only requirement limit exposure in properly secured environments.

## Mentioned in this report

- Vulnerabilities: CVE-2025-43715

## Detection guidance (public sample)

### SYSTEM-Level Process Launched From NSIS Temporary Plugin Directory

ATT&CK: T1548.004

Detects an executable running as SYSTEM from an NSIS nsX.tmp temporary directory, the end state of the NSIS plugin-directory race condition where an attacker-planted binary is executed by an elevated installer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SYSTEM-Level Process Launched From NSIS Temporary Plugin Directory
description: Detects an executable running as SYSTEM from an NSIS-style nsX.tmp temporary
  directory. In the NSIS plugin-directory race condition an attacker places a crafted
  binary in the temp directory before the elevated installer uses it, giving code
  execution with SYSTEM privileges. Matches the directory pattern and integrity context,
  not any specific product name.
tags:
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    User|contains:
    - SYSTEM
    - "SYST\xC8ME"
    Image|re: \\ns[a-z0-9]{1,8}\.tmp\\[^\\]+\.exe$
  condition: selection
falsepositives:
- Legitimate NSIS installers deployed via SCCM or other software deployment run as
  SYSTEM and may launch helper executables (for example redistributable installers)
  from their nsX.tmp directory
level: medium
id: c795f37c-afd2-5324-b4be-db4d1760da70
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
```

### SYSTEM Process Loading DLL From NSIS Temporary Plugin Directory

ATT&CK: T1548.004

Detects a SYSTEM process loading a DLL from an NSIS nsX.tmp directory, which could be a planted DLL that wins the plugin-directory race. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SYSTEM Process Loading DLL From NSIS Temporary Plugin Directory
description: Detects a process running as SYSTEM loading a DLL from an NSIS-style
  nsX.tmp temporary directory under a Temp path. Exploitation of the NSIS plugin-directory
  race condition causes the elevated installer to load an attacker-supplied plugin
  DLL. Needs tuning against legitimate NSIS plugin loads (System.dll, nsExec.dll)
  in managed deployments.
tags:
- attack.privilege-escalation
- attack.t1548.004
logsource:
  category: image_load
  product: windows
detection:
  selection:
    User|contains:
    - SYSTEM
    - "SYST\xC8ME"
    ImageLoaded|re: \\temp\\ns[a-z0-9]{1,8}\.tmp\\[^\\]+\.dll$
  condition: selection
falsepositives:
- SYSTEM-context deployment of legitimate NSIS installers, which load their own plugin
  DLLs such as System.dll from the nsX.tmp directory
level: low
id: 31e9c52d-ba9a-5c43-a3b9-cbeba9cd8333
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
```

### Executable or DLL Dropped Into NSIS Temporary Directory

ATT&CK: T1036

Detects creation of PE files inside an NSIS nsX.tmp temp directory, including binaries planted by another process to win the race. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Executable or DLL Dropped Into NSIS Temporary Directory
description: Detects creation of .exe or .dll files in an NSIS-style nsX.tmp directory
  under a Temp path. Attackers exploiting the NSIS plugin-directory race condition
  write a crafted binary there, impersonating an installer plugin, before the elevated
  installer validates the directory. Triage by checking whether the writing process
  is the installer itself or an unrelated process.
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1548.004
- attack.t1036
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|re: \\temp\\ns[a-z0-9]{1,8}\.tmp\\[^\\]+\.(dll|exe)$
  filter_system_dll:
    TargetFilename|endswith:
    - \System.dll
    - \nsExec.dll
  condition: selection and not filter_system_dll
falsepositives:
- Legitimate NSIS installers extracting helper executables or plugin DLLs to their
  temp directory during normal installation
level: low
id: 5189f0c7-86d3-5844-a749-6fcadbd9fb96
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b25930cc-80d4-5c44-b996-68398d4f5df7/siemens-simotion-tools-privilege-escalation-via-nsis-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup