CVE-2025-27395 Siemens CVE debrief

Who should care

Operators and administrators of Siemens SCALANCE LPE9403 devices, especially OT/ICS teams that allow SFTP access for maintenance or file transfer. Security teams responsible for privileged account control, device hardening, and patch management in industrial environments should prioritize review.

Technical summary

The advisory describes an authorization and access-scope failure in the device’s SFTP functionality. The weakness is not a lack of authentication; rather, it affects what an already authenticated, highly privileged remote user can do once connected. The result is potential arbitrary file read/write on the appliance, which raises the risk of configuration tampering, data exposure, or device integrity impact. The published CVSS vector reflects network reachability, low attack complexity, required high privileges, and high impact to confidentiality, integrity, and availability.

Defensive priority

High. The issue requires high privileges, but the impact is broad and the affected product is used in industrial settings where file integrity and device configuration matter. Patch promptly and review any exposed or privileged SFTP usage.

Recommended defensive actions

• Update Siemens SCALANCE LPE9403 to V4.0 or later as directed in the vendor remediation.
• Review which accounts can use SFTP and ensure only strictly necessary privileged users retain access.
• Restrict network reachability to management and file-transfer interfaces to trusted administrative sources only.
• Monitor for unexpected file changes, configuration drift, or suspicious SFTP activity on affected devices.
• Validate backups and recovery procedures so the device can be restored if file tampering occurs.
• Consult the Siemens advisory and CISA ICS guidance for device-specific hardening and industrial network defense practices.

Evidence notes

This debrief is based only on the supplied CISA CSAF record for ICSA-25-072-06 and the linked Siemens advisory references. The advisory text explicitly states that affected devices do not properly limit the scope of files accessible through SFTP and the privileges of the SFTP functionality, enabling an authenticated highly-privileged remote attacker to read and write arbitrary files. The published date used here is 2025-03-11, with a later 2025-05-06 revision noted as typo fixes.

Official resources