Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-327438 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT; Luca Borzacchiello (Nozomi Networks)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-40574 | CWE-732 Incorrect Permission Assignment for Critical Resource | 7.8 High |
CVE-2025-40574 Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to interact with the backupmanager service. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40582 | CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 7.8 High |
CVE-2025-40582 Affected devices do not properly sanitize configuration parameters. This could allow a non-privileged local attacker to execute root commands on the device. Mitigation: Only use trusted SINEMA Remote Connect Servers Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V2.1 HF0 or later version Available on Industrial Edge Hub for ARM 64 and X86 Affected, fixed & timelineAffected:
|
| CVE-2025-40581 | CWE-288 Authentication Bypass Using an Alternate Path or Channel | 7.1 High |
CVE-2025-40581 Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V2.1 HF0 or later version Available on Industrial Edge Hub for ARM 64 and X86 Affected, fixed & timelineAffected:
|
| CVE-2025-40579 | CWE-121 Stack-based Buffer Overflow | 6.7 Medium |
CVE-2025-40579 Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40580 | CWE-121 Stack-based Buffer Overflow | 6.7 Medium |
CVE-2025-40580 Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40572 | CWE-732 Incorrect Permission Assignment for Critical Resource | 5.5 Medium |
CVE-2025-40572 Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to access sensitive information stored on the device. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40573 | CWE-35 Path Traversal: '.../...//' | 4.4 Medium |
CVE-2025-40573 Affected devices are vulnerable to path traversal attacks. This could allow a privileged local attacker to restore backups that are outside the backup folder. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40583 | CWE-319 Cleartext Transmission of Sensitive Information | 4.4 Medium |
CVE-2025-40583 Affected devices do transmit sensitive information in cleartext. This could allow a privileged local attacker to retrieve this sensitive information. Mitigation: Restrict access to authorized and trusted personal only Vendor fix: Update to V2.1 HF0 or later version Available on Industrial Edge Hub for ARM 64 and X86 Affected, fixed & timelineAffected:
|
| CVE-2025-40575 | CWE-457 Use of Uninitialized Variable | 4.3 Medium |
CVE-2025-40575 Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process. Mitigation: Disable the Profinet Discovery and Configuration Protocol (DCP) service Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40576 | CWE-476 NULL Pointer Dereference | 4.3 Medium |
CVE-2025-40576 Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process. Mitigation: Disable the Profinet Discovery and Configuration Protocol (DCP) service Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40577 | CWE-125 Out-of-bounds Read | 4.3 Medium |
CVE-2025-40577 Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process. Mitigation: Disable the Profinet Discovery and Configuration Protocol (DCP) service Vendor fix: Update to V4.0 HF0 or later version ↗ Affected, fixed & timelineAffected:
|
| CVE-2025-40578 | CWE-125 Out-of-bounds Read | 4.3 Medium |
CVE-2025-40578 Affected devices do not properly handle multiple incoming Profinet packets received in rapid succession. An unauthenticated remote attacker can exploit this flaw by sending multiple packets in a very short time frame, which leads to a crash of the dcpd process. Mitigation: Disable the Profinet Discovery and Configuration Protocol (DCP) service No fix planned: Currently no fix is planned Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-40574 | 7.8 High | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permi… |
| CVE-2025-40582 | 7.8 High | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installe… |
| CVE-2025-40581 | 7.1 High | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installe… |
| CVE-2025-40579 | 6.7 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-ba… |
| CVE-2025-40580 | 6.7 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-ba… |
| CVE-2025-40572 | 5.5 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permi… |
| CVE-2025-40573 | 4.4 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to path trave… |
| CVE-2025-40583 | 4.4 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installe… |
| CVE-2025-40575 | 4.3 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate inc… |
| CVE-2025-40576 | 4.3 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate inc… |
| CVE-2025-40577 | 4.3 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate inc… |
| CVE-2025-40578 | 4.3 Medium | Siemens SCALANCE LPE9403 A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). Affected devices do not properly handle multiple incomin… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.