CVE-2025-40594CWE-269privilege-escalation

CVE-2025-40594

Medium · published September 9, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-09-09T13:15Z
Affected products (5)
ProductVersionsFixed in
siemens/sinamics_g220_firmwareall versions—
siemens/sinamics_g220_firmwareall versions—
siemens/sinamics_s200_firmwareall versions—
siemens/sinamics_s210_firmwareall versions—
siemens/sinamics_s210_firmwareall versions—
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-027652.html · [email protected]
EPSS history
Timeline
  • 09 SEP 08:47Z
    A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All…
    cvelistv5