CVE-2025-40556 Siemens CVE debrief

Who should care

OT/ICS operators, facilities teams, and network engineers responsible for Siemens BACnet ATEC deployments or shared BACnet MSTP segments should review this issue, especially where device availability is operationally critical.

Technical summary

The affected devices improperly handle specific incoming BACnet MSTP messages. The impact is limited to availability: an attacker residing on the same BACnet network can send a crafted MSTP message that causes the targeted device to stop operating normally until it is power cycled. The advisory lists BACnet ATEC 550-440, 550-441, 550-445, and 550-446, and notes that no fix is currently planned.

Defensive priority

Medium. The CVSS score is 6.5 with high availability impact, and the issue can disrupt OT operations until manual recovery. Prioritize mitigation if these devices are deployed on shared or weakly segmented BACnet networks.

Recommended defensive actions

• Identify whether BACnet ATEC 550-440, 550-441, 550-445, or 550-446 devices are in use and document where they sit in the BACnet network.
• Restrict access to BACnet MSTP segments to trusted controllers and maintenance systems only.
• Review segmentation and bridging between BACnet networks and other network zones to reduce exposure to same-network attackers.
• Monitor for abnormal BACnet MSTP traffic and device hang behavior, and ensure operators have a tested recovery procedure for power-cycle restoration.
• Apply CISA and vendor defense-in-depth guidance for industrial control systems, including least-privilege network access and layered segmentation.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-25-135-03 and the Siemens security advisory SSA-828116, both published on 2025-05-13. The supplied advisory text explicitly states that affected devices mishandle specific BACnet MSTP messages, that a same-network attacker can cause a denial of service, and that a power cycle is required for recovery. The supplied remediations field states that no fix is currently planned. No KEV entry is indicated in the provided data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.