Sign-up

ID

VAR-202508-0356


CVE

CVE-2025-40751


TITLE

Siemens'  SIMATIC RTLS Locating Manager  Vulnerability regarding insufficient protection of authentication information in

Trust: 0.8

sources: JVNDB: JVNDB-2025-012037

DESCRIPTION

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role. Siemens' SIMATIC RTLS Locating Manager There are vulnerabilities in inadequate protection of credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2025-40751 // JVNDB: JVNDB-2025-012037

AFFECTED PRODUCTS

vendor:siemensmodel:simatic rtls locating managerscope:ltversion:3.3

Trust: 1.0

vendor:シーメンスmodel:simatic rtls locating managerscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:simatic rtls locating managerscope:eqversion:3.3

Trust: 0.8

vendor:シーメンスmodel:simatic rtls locating managerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2025-012037 // NVD: CVE-2025-40751

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2025-40751
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2025-40751
value: HIGH

Trust: 1.0

NVD: CVE-2025-40751
value: HIGH

Trust: 0.8

productcert@siemens.com: CVE-2025-40751
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 2.0
impactScore: 3.7
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-40751
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2025-40751
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2025-012037 // NVD: CVE-2025-40751 // NVD: CVE-2025-40751

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.0

problemtype:Inadequate protection of credentials (CWE-522) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-012037 // NVD: CVE-2025-40751

EXTERNAL IDS

db:NVDid:CVE-2025-40751

Trust: 2.6

db:SIEMENSid:SSA-707630

Trust: 1.8

db:ICS CERTid:ICSA-25-226-01

Trust: 0.8

db:JVNid:JVNVU92169998

Trust: 0.8

db:JVNDBid:JVNDB-2025-012037

Trust: 0.8

sources: JVNDB: JVNDB-2025-012037 // NVD: CVE-2025-40751

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-707630.html

Trust: 1.8

url:https://jvn.jp/vu/jvnvu92169998/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-40751

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-01

Trust: 0.8

sources: JVNDB: JVNDB-2025-012037 // NVD: CVE-2025-40751

SOURCES

db:JVNDBid:JVNDB-2025-012037
db:NVDid:CVE-2025-40751

LAST UPDATE DATE

2025-08-24T19:35:29.955000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2025-012037date:2025-08-21T09:17:00
db:NVDid:CVE-2025-40751date:2025-08-20T20:57:21.200

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2025-012037date:2025-08-21T00:00:00
db:NVDid:CVE-2025-40751date:2025-08-12T12:15:36.190