Sign-up

ID

VAR-202502-0237


CVE

CVE-2025-23403


TITLE

Siemens SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor Weak Registry Privilege Escalation Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-15320

DESCRIPTION

A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restrict the user permission for the registry key. This could allow an authenticated attacker to load vulnerable drivers into the system leading to privilege escalation or bypassing endpoint protection and other security measures. SIMATIC IPC DiagBase is a system monitoring and troubleshooting software that identifies any potential faults on SIMATIC IPCs at an early stage and helps to avoid or reduce system downtime. SIMATIC IPC DiagMonitor monitors, reports, visualizes and logs the system status of SIMATIC IPCs. It communicates with other systems and reacts when events occur

Trust: 1.44

sources: NVD: CVE-2025-23403 // CNVD: CNVD-2025-15320

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-15320

AFFECTED PRODUCTS

vendor:siemensmodel:simatic ipc diagbasescope: - version: -

Trust: 0.6

vendor:siemensmodel:simatic ipc diagmonitorscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-15320

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2025-23403
value: HIGH

Trust: 1.0

CNVD: CNVD-2025-15320
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-15320
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

productcert@siemens.com: CVE-2025-23403
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-15320 // NVD: CVE-2025-23403

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.0

sources: NVD: CVE-2025-23403

EXTERNAL IDS

db:NVDid:CVE-2025-23403

Trust: 1.6

db:SIEMENSid:SSA-369369

Trust: 1.6

db:CNVDid:CNVD-2025-15320

Trust: 0.6

sources: CNVD: CNVD-2025-15320 // NVD: CVE-2025-23403

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-369369.html

Trust: 1.6

sources: CNVD: CNVD-2025-15320 // NVD: CVE-2025-23403

SOURCES

db:CNVDid:CNVD-2025-15320
db:NVDid:CVE-2025-23403

LAST UPDATE DATE

2025-07-13T23:35:42.608000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-15320date:2025-07-09T00:00:00
db:NVDid:CVE-2025-23403date:2025-02-11T11:15:16.420

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-15320date:2025-02-11T00:00:00
db:NVDid:CVE-2025-23403date:2025-02-11T11:15:16.420