CVE-2025-40771
Full vulnerability record from the local CVENow database.
Description
A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.4.24). Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2025-10-14 10:15:38.297000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40771",
"sourceIdentifier": "[email protected]",
"published": "2025-10-14T10:15:38.297",
"lastModified": "2026-10-23T22:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.4.24). Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (Todas las versiones anteriores a V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (Todas las versiones anteriores a V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (Todas las versiones anteriores a V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (Todas las versiones anteriores a V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (Todas las versiones anteriores a V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (Todas las versiones anteriores a V2.4.24). Los dispositivos afectados no autentican correctamente las conexiones de configuración. Esto podría permitir a un atacante remoto no autenticado acceder a los datos de configuración."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC CP 1542SP-1",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V2.4.24",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC CP 1542SP-1 IRC",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V2.4.24",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC CP 1543SP-1",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V2.4.24",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V2.4.24",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS ET 200SP CP 1543SP-1 ISEC",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V2.4.24",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V2.4.24",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-14T18:59:33.962995Z",
"id": "CVE-2025-40771",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-486936.html",
"source": "[email protected]"
}
]
}