CVE-2025-40594
Full vulnerability record from the local CVENow database.
Description
A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Modified
Source identifier
Published
2025-09-09 09:15:36.743000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40594",
"sourceIdentifier": "[email protected]",
"published": "2025-09-09T09:15:36.743",
"lastModified": "2026-10-23T22:10:00.160",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges."
},
{
"lang": "es",
"value": "Una vulnerabilidad ha sido identificada en SINAMICS G220 V6.4 (Todas las versiones anteriores a V6.4 HF2), SINAMICS S200 V6.4 (Todas las versiones anteriores a V6.4 HF7), SINAMICS S210 V6.4 (Todas las versiones anteriores a V6.4 HF2). Los dispositivos afectados permiten que se ejecute un restablecimiento de fábrica sin los privilegios requeridos debido a una gestión de privilegios inadecuada, así como la manipulación de datos de configuración debido a privilegios filtrados de sesiones anteriores. Esto podría permitir a un atacante no autorizado escalar sus privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Siemens",
"product": "SINAMICS G220 V6.4",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V6.4 HF2",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SINAMICS S200 V6.4",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V6.4 HF7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SINAMICS S210 V6.4",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V6.4 HF2",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.0,
"impactScore": 4.7
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-09T19:35:59.919331Z",
"id": "CVE-2025-40594",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sinamics_g220_firmware:6.4:-:*:*:*:*:*:*",
"matchCriteriaId": "826EA8F0-D952-45B0-992D-06FDD69C15DE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sinamics_g220_firmware:6.4:hf1:*:*:*:*:*:*",
"matchCriteriaId": "A667304B-DA27-4774-9E2D-427C8F82D92A"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sinamics_g220:-:-:*:*:*:*:*:*",
"matchCriteriaId": "E1338801-EE2C-4B79-90CD-B89DC5D62222"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sinamics_s200_firmware:6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "177B0059-39B2-446B-9EE4-990A3B8DAE14"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sinamics_s200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A55ADD0-B32D-41F8-BB59-003440BEBA01"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sinamics_s210_firmware:6.4:-:*:*:*:*:*:*",
"matchCriteriaId": "1DB28153-EF8D-4D75-B9B2-24EE4C1030D5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:siemens:sinamics_s210_firmware:6.4:hf1:*:*:*:*:*:*",
"matchCriteriaId": "9F006E81-F8BF-4EA6-A972-B4209AF59C2C"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:siemens:sinamics_s210:-:-:*:*:*:*:*:*",
"matchCriteriaId": "AF9F61F7-F7F3-45FE-8029-D1DD034FF993"
}
]
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-027652.html",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}