CVE-2025-40771

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.4.24). Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Siemens	SIMATIC CP 1542SP-1	< V2.4.24
Siemens	SIMATIC CP 1542SP-1 IRC	< V2.4.24
Siemens	SIMATIC CP 1543SP-1	< V2.4.24
Siemens	SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL	< V2.4.24
Siemens	SIPLUS ET 200SP CP 1543SP-1 ISEC	< V2.4.24
Siemens	SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL	< V2.4.24

References

https://cert-portal.siemens.com/productcert/html/ssa-486936.html

Timeline

Published: Oct 14, 2025
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-407726.1A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-CVE-2025-407735.3A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access contro CVE-2025-407744.4A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted CVE-2025-407757.5When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value CVE-2025-407768.6A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This i CVE-2025-407777.5If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only all CVE-2025-407788.6Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the ca CVE-2025-407797.5If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` p CVE-2025-40784.3A vulnerability, which was classified as problematic, has been found in Wangshen SecGate 3600 2400. This issue affects some unknown processi CVE-2025-407808.6In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to pr CVE-2025-40799.8A vulnerability, which was classified as critical, was found in PCMan FTP Server up to 2.0.7. Affected is an unknown function of the compone CVE-2025-407959.8A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All v