CVE-2025-40568 Siemens CVE debrief

Who should care

Siemens customers and operators running affected RUGGEDCOM RST2428P or impacted SCALANCE devices, especially OT administrators, network operations teams, and security teams responsible for account governance and firmware maintenance.

Technical summary

The issue is an incorrect authorization check in an internal session-termination function exposed through the web interface. Because the attacker must already be authenticated and hold the guest role, the impact is limited to availability: a guest user may be able to terminate other users’ sessions. The supplied CVSS vector reflects network reachability, low attack complexity, low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, and low availability impact.

Defensive priority

Medium. The flaw is authenticated-only and availability-focused, but it affects OT network and device management interfaces where session disruption can still interfere with operations.

Recommended defensive actions

• Update affected devices to Siemens version V3.2 or later, per the vendor remediation.
• Verify exact model and part number against the Siemens/CISA affected-product list before scheduling changes.
• Review guest-role assignments and remove or minimize guest access where operationally possible.
• Apply OT defense-in-depth and access-control practices from CISA guidance, including limiting administrative exposure and monitoring management-plane activity.
• If immediate updating is not possible, use compensating controls to restrict access to the web interface and closely monitor for unexpected session termination events.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-162-04 and the linked Siemens ProductCERT advisory SSA-693776. The source description states that the vulnerability is an incorrect authorization check in internal session termination functionality and that an authenticated remote attacker with guest role could terminate legitimate users’ sessions. Remediation is listed as V3.2 or later for the affected product IDs. The source advisory revision history shows an initial publication on 2025-06-10, a 2026-01-13 correction to one SCALANCE family being known not affected, and a 2026-01-14 republication of Siemens ProductCERT advisory content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.