Siemens SIPROTEC 5 Unrestricted File Upload Vulnerability Advisory

Vulnerability Overview Vulnerability Name: SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGIS5 Protocol Release Date: 2026-06-09 Last Update: 2026-06-09 Current Version: V1.0 CVSS v3.1 Base Score: 6.1 CVSS v4.0 Base Score: 6.9 Vulnerability Description: SIPROTEC 5 contains a vulnerability that allows authenticated users to perform arbitrary file uploads via the DIGIS5 protocol. An attacker could upload malicious configuration files, potentially leading to a denial of service. Affected Products Affected Products: - SIPROTEC 5 - CP100 Devices - SIPROTEC 5 - CP150 Devices - SIPROTEC 5 - CP200 Devices - SIPROTEC 5 - CP300 Devices - SIPROTEC 5 Compact 7SX800 (CP50) Mitigation Mitigation Measures: - For CP50 and CP150 devices, it is recommended to upgrade to version 9.90 or later. - For CP200 devices, it is recommended to upgrade to version 10.00 or later. - For TS185 and TS7188 devices, it is recommended to upgrade to version 9.90 or later. - For all other remaining devices, it is recommended to upgrade to version 9.90 or later, which introduces new functionality to restrict arbitrary file uploads. Specific Mitigation Measures: - Enable Role-Based Access Control (RBAC) for CP50, CP100, CP150, and CP300 devices. - Apply password protection to all DIGIS5 connections to ensure secure communication. - Configure user certificates for DIGIS5 access. Further Recommendations: - Users should upgrade to version 9.90 or later, which introduces new functionality to restrict arbitrary file uploads. - Refer to the Partial Mitigation section for additional recommendations. Additional Information General Security Recommendations: - Operators should verify that appropriate resilience measures are in place. - Validation should be performed before applying any security updates. - It is recommended to configure the environment in accordance with the operational guidelines. Vulnerability Description: - Vulnerability CVE-2025-40808 allows authenticated users to upload arbitrary files via the DIGIS5 protocol, which may lead to a denial of service. CVSS Scores: - CVSS v3.1 Base Score: 6.1 - CVSS v4.0 Base Score: 6.9 CWE: - CWE-434: Unrestricted Upload of File with Dangerous Type Credits: - Thanks to Humza Ahmad for reporting this vulnerability from ENCS. Additional Information: - For more information about Siemens products and security solutions, please contact Siemens ProductCERT. History: - V1.0 (2026-06-09): Release date Terms of Use: - Use of Siemens security advisories is subject to relevant terms and conditions.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SIPROTEC 5 Unrestricted File Upload Vulnerability Advisory