CVE-2025-40594

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2025
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-405957.2A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded UR CVE-2025-405967.3A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Se CVE-2025-405977.5A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Ser CVE-2025-405986.1A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker t CVE-2025-405999.1An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administr CVE-2025-40609.8A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown pro CVE-2025-406009.8Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause CVE-2025-406017.5A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Servic CVE-2025-406026.6A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).CVE-2025-406034.5A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administr CVE-2025-406049.8Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verify CVE-2025-406055.3A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by inj