IM
IronMonkey Threat Research

CVE-2025-40581 HIGH

Published: 2025-05-13 | Last Modified: 2026-09-08 | Status: Modified

Description

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters.

Additional Descriptions (1)

Se ha identificado una vulnerabilidad en SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (todas las versiones con SINEMA Remote Connect Edge Client instalado). Los dispositivos afectados son vulnerables a una omisión de autenticación. Esto podría permitir que un atacante local sin privilegios omita la autenticación de SINEMA Remote Connect Edge Client y lea y modifique los parámetros de configuración.

CVSS Metrics

Base Score: 7.1 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Secondary

Exploitability Score: 1.8

Impact Score: 5.2

Base Score: 8.4 (HIGH)

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack VectorLOCAL
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredLOW
User InteractionNONE
Vulnerability ConfidentialityHIGH
Vulnerability IntegrityHIGH
Vulnerability AvailabilityNONE
Subsequent ConfidentialityNONE
Subsequent IntegrityNONE
Subsequent AvailabilityNONE

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-288
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
siemens scalance_lpe9403_firmware - <built-in method update of dict object at 0x7d24245ae3c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_lpe9403_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_lpe9403:-:*:*:*:*:*:*:*

References

Notification
Message here