CVE-2025-30034 Denial of service in SIMATIC RTLS Locating Manager
An unauthenticated local attacker can cause a denial of service in SIMATIC RTLS Locating Manager by sending invalid input to the local loopback interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30034?
CVE-2025-30034 is a medium-severity denial of service vulnerability in Siemens SIMATIC RTLS Locating Manager, published on 12 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition.
Weakness: CWE-617
Which versions are affected by CVE-2025-30034?
It affects 1 product.
Products include Siemens Simatic Rtls Locating Manager.
How do I fix CVE-2025-30034?
No fix has been published for CVE-2025-30034 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30034 being exploited?
There is no known exploitation of CVE-2025-30034 in the wild and no public exploit code.
Other vulnerabilities in Siemens SIMATIC RTLS Locating Manager
- CVE-2025-40746 Command injection in SIMATIC RTLS Locating Manager
- CVE-2020-10050 A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2).
- CVE-2020-10051 Command injection in SIMATIC RTLS Locating Manager
- CVE-2020-10049 Command injection in SIMATIC RTLS Locating Manager
- CVE-2020-10052 Information disclosure in SIMATIC RTLS Locating Manager
Sources
Also known as GHSA-7qcc-qfv9-f87g.