CVE-2025-27394 Siemens CVE debrief

Who should care

Organizations running Siemens SCALANCE LPE9403 devices, especially OT/industrial environments where privileged administrators manage SNMP settings. Network and ICS security teams should also care if administrative access to the device is exposed or broadly shared.

Technical summary

The issue is an input-sanitization weakness in the SNMP user creation path on the affected Siemens device. The published CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) indicates a network-reachable flaw that requires high privileges but no user interaction, with potential high impact to confidentiality, integrity, and availability. The source advisory names one affected product: SCALANCE LPE9403 (6GK5998-3GS00-2AC2).

Defensive priority

High. Although exploitation requires authenticated, highly privileged access, the impact is severe and the attack path is remote. Prioritize this for any exposed or operationally critical SCALANCE LPE9403 deployment, and especially where SNMP administration is actively used.

Recommended defensive actions

• Update Siemens SCALANCE LPE9403 devices to V4.0 or later, per the vendor remediation.
• Restrict access to device administration interfaces to only trusted management hosts and personnel.
• Review who has the privileged credentials used to create or manage SNMP users, and remove unnecessary access.
• Monitor for unusual SNMP administration activity or unexpected changes to device configuration.
• Follow CISA and Siemens industrial control system hardening guidance for defense-in-depth and least-privilege administration.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-072-06 for CVE-2025-27394, published on 2025-03-11 and revised on 2025-05-06 for typo fixes only. The advisory identifies Siemens as the vendor, the affected product as SCALANCE LPE9403 (6GK5998-3GS00-2AC2), and the remediation as updating to V4.0 or later. The CVSS vector supplied in the advisory is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C. No KEV entry is provided in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.