CVE-2025-40573 Siemens CVE debrief

Who should care

Operators and maintainers of Siemens SCALANCE LPE9403 deployments, especially environments where privileged local access is possible or not tightly controlled. Industrial control and OT teams should also care because the advisory is published through CISA/ICS channels.

Technical summary

The advisory describes a path traversal condition in Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2). The stated impact is limited to a privileged local attacker and is consistent with the supplied CVSS vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. The disclosed effect is integrity-focused: unauthorized restoration of backups outside the backup directory. No fix was available in the source advisory at the time of publication.

Defensive priority

Medium. The attack requires local access and high privileges, which narrows exposure, but the integrity impact and lack of a fix justify prompt access-control hardening and monitoring in affected environments.

Recommended defensive actions

• Restrict access to the device to authorized and trusted personnel only, as stated in the advisory.
• Review who has privileged local access to affected SCALANCE LPE9403 systems and remove unnecessary access.
• Protect backup workflows and verify that restore operations are limited to intended directories and approved operators.
• Monitor vendor and CISA advisory updates for a future fix or additional mitigation guidance.
• Apply general ICS defense-in-depth and access-control practices referenced by the advisory when operating OT assets.

Evidence notes

The source CSAF advisory (ICSA-25-135-18) states: 'Affected devices are vulnerable to path traversal attacks. This could allow a privileged local attacker to restore backups that are outside the backup folder.' The advisory metadata lists Siemens as the vendor, SCALANCE LPE9403 (6GK5998-3GS00-2AC2) as the affected product, CVSS v3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, publication date 2025-05-13, and remediation guidance of restricting access to authorized and trusted personnel with no fix available at publication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.