Siemens SCALANCE LPE9403 Security Advisory: Multiple CVEs (RCE, Auth Bypass, Info Disclosure)

Critical Vulnerability Information Vulnerability Overview Advisory ID: SSA-327438 Product: SCALANCE LPE9403 (6GK5985-3SG00-2AC2) Release Date: 2025-05-13 CVSS Score: - v3.1 Base Score: 7.8 - v4.0 Base Score: 8.5 Affected Products and Versions Affected Products and Versions: SCALANCE LPE9403 (6GK5985-3SG00-2AC2) Remediation: No fix currently available. Refer to the "Workarounds and Mitigations" section for recommended actions. Workarounds and Mitigations CVE-2025-40572, CVE-2025-40573, CVE-2025-40574, CVE-2025-40579, CVE-2025-40580, CVE-2025-40581, CVE-2025-40582, CVE-2025-40583: Restrict access to authorized and trusted personnel only. CVE-2025-40575, CVE-2025-40576, CVE-2025-40577, CVE-2025-40578: Disable Profinet services. CVE-2025-40582: Use only trusted SINEC Remote Connect servers. Vulnerability Descriptions CVE-2025-40572: The device does not properly assign permissions to critical resources, potentially allowing a non-privileged local attacker to access sensitive information stored on the device. CVE-2025-40573: Path traversal vulnerability, allowing a privileged local attacker to access backup folders. CVE-2025-40574: The device does not properly assign permissions to critical resources, potentially allowing a non-privileged local attacker to interact with the backup manager. CVE-2025-40575: The device does not properly validate incoming Profinet packets, allowing a remote attacker to send malicious packets that cause the process to crash. CVE-2025-40576: The device does not properly validate incoming Profinet packets, allowing a remote attacker to send malicious packets that cause the process to crash. CVE-2025-40577: The device does not properly handle rapid, consecutive receipt of multiple Profinet packets, allowing a remote attacker to send multiple packets and cause the process to crash. CVE-2025-40578: Stack buffer overflow, allowing a non-privileged local attacker to execute arbitrary code or cause service disruption. CVE-2025-40579: Stack buffer overflow, allowing a non-privileged local attacker to execute arbitrary code or cause service disruption. CVE-2025-40580: Authentication bypass, allowing a non-privileged local attacker to read and modify configuration parameters. CVE-2025-40581: Configuration parameters are not properly sanitized, allowing a non-privileged local attacker to execute root commands. CVE-2025-40582: Sensitive information is transmitted in plaintext, allowing a privileged local attacker to obtain sensitive information.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SCALANCE LPE9403 Security Advisory: Multiple CVEs (RCE, Auth Bypass, Info Disclosure)