9.8

CVE-2025-40594

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Sinamics G220 Firmware Version 6.4 Update -
   Siemens ≫ Sinamics G220 Version - Update -
Siemens ≫ Sinamics G220 Firmware Version 6.4 Update hf1
   Siemens ≫ Sinamics G220 Version - Update -
Siemens ≫ Sinamics S200 Firmware Version 6.4
   Siemens ≫ Sinamics S200 Version -
Siemens ≫ Sinamics S210 Firmware Version 6.4 Update -
   Siemens ≫ Sinamics S210 Version - Update -
Siemens ≫ Sinamics S210 Firmware Version 6.4 Update hf1
   Siemens ≫ Sinamics S210 Version - Update -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.111
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Siemens 6.9 0 0
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Siemens 6.3 1 4.7
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://cert-portal.siemens.com/productcert/html/ssa-027652.html
Vendor Advisory