CVE-2020-25245

HIGH 7.8CVE-2020-25245 · Published 09/02/2021 · updated 17/06/2026

In short

CVE-2020-25245 is a HIGH (CVSS 7.8) vulnerability affecting digsi 4 (siemens).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.3% of all vulnerabilities.
Fix: update to 4.94 or later.

Package	Affected versions	Patched versions
digsi 4 siemens	`= 4.94< 4.94`	`4.94`

Description

A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM.

References

cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf · Vendor Advisory
us-cert.cisa.gov/ics/advisories/icsa-21-040-10 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free