As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v4 6.9
- ATTENTION: Exploitable from a local network
- Vendor: Siemens
- Equipment: SINAMICS Drives
- Vulnerability: Improper Privilege Management
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow users to escalate their privileges.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following products are affected:
- Siemens SINAMICS G220 V6.4: Versions prior to V6.4 HF2
- Siemens SINAMICS S200 V6.4: All versions
- Siemens SINAMICS S210 V6.4: Versions prior to V6.4 HF2
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER PRIVILEGE MANAGEMENT CWE-269
The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.
CVE-2025-40594 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L).
A CVSS v4 score has also been calculated for CVE-2025-40594<
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: