Sign-up

ID

VAR-202505-1597


CVE

CVE-2025-40581


TITLE

Siemens'  SCALANCE LPE9403  Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2025-006312

DESCRIPTION

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters. Siemens' SCALANCE LPE9403 There are unspecified vulnerabilities in the firmware.Information may be obtained and information may be tampered with. The Siemens SCALANCE LPE9403 is a local processing engine designed by Siemens for industrial field data processing. It is used to capture, collect, and pre-process industrial field data

Trust: 2.16

sources: NVD: CVE-2025-40581 // JVNDB: JVNDB-2025-006312 // CNVD: CNVD-2025-17499

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-17499

AFFECTED PRODUCTS

vendor:siemensmodel:scalance lpe9403scope:eqversion: -

Trust: 1.0

vendor:シーメンスmodel:scalance lpe9403scope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:scalance lpe9403scope:eqversion:scalance lpe9403 firmware

Trust: 0.8

vendor:シーメンスmodel:scalance lpe9403scope: - version: -

Trust: 0.8

vendor:siemensmodel:scalance lpe9403scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-17499 // JVNDB: JVNDB-2025-006312 // NVD: CVE-2025-40581

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2025-40581
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-006312
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-17499
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-17499
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:L/AU:S/C:C/I:C/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: NONE
exploitabilityScore: 3.1
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

productcert@siemens.com: CVE-2025-40581
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 5.2
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-006312
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-17499 // JVNDB: JVNDB-2025-006312 // NVD: CVE-2025-40581

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-288

Trust: 1.0

problemtype:Authentication Bypass Using Alternate Paths or Channels (CWE-288) [ others ]

Trust: 0.8

problemtype: Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-006312 // NVD: CVE-2025-40581

PATCH

title:Patch for Siemens SCALANCE LPE9403 Security Bypass Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/715146

Trust: 0.6

sources: CNVD: CNVD-2025-17499

EXTERNAL IDS

db:NVDid:CVE-2025-40581

Trust: 3.2

db:SIEMENSid:SSA-327438

Trust: 2.4

db:ICS CERTid:ICSA-25-135-18

Trust: 0.8

db:JVNid:JVNVU92528757

Trust: 0.8

db:JVNDBid:JVNDB-2025-006312

Trust: 0.8

db:CNVDid:CNVD-2025-17499

Trust: 0.6

sources: CNVD: CNVD-2025-17499 // JVNDB: JVNDB-2025-006312 // NVD: CVE-2025-40581

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-327438.html

Trust: 2.4

url:https://jvn.jp/vu/jvnvu92528757/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-40581

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-18

Trust: 0.8

sources: CNVD: CNVD-2025-17499 // JVNDB: JVNDB-2025-006312 // NVD: CVE-2025-40581

SOURCES

db:CNVDid:CNVD-2025-17499
db:JVNDBid:JVNDB-2025-006312
db:NVDid:CVE-2025-40581

LAST UPDATE DATE

2025-08-06T22:52:28.818000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-17499date:2025-08-05T00:00:00
db:JVNDBid:JVNDB-2025-006312date:2025-06-05T05:58:00
db:NVDid:CVE-2025-40581date:2025-06-04T16:33:41.450

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-17499date:2025-08-05T00:00:00
db:JVNDBid:JVNDB-2025-006312date:2025-06-05T00:00:00
db:NVDid:CVE-2025-40581date:2025-05-13T10:15:28.333