PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-40577 Siemens CVE debrief

CVE-2025-40577 is a Siemens SCALANCE LPE9403 issue in which incoming Profinet packets are not properly validated. According to the advisory, an attacker can trigger a crash of the dcpd process by sending a specially crafted packet. Siemens/CISA list no fix at publication time and recommend disabling the Profinet Discovery and Configuration Protocol (DCP) service where feasible.

Vendor
Siemens
Product
SCALANCE LPE9403 (6GK5998-3GS00-2AC2)
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-13
Original CVE updated
2025-05-13
Advisory published
2025-05-13
Advisory updated
2025-05-13

Who should care

OT/ICS operators, plant engineers, and network defenders responsible for Siemens SCALANCE LPE9403 devices, especially environments using Profinet and DCP on trusted industrial networks.

Technical summary

The advisory states that affected devices fail to properly validate incoming Profinet packets. A crafted packet can cause a denial-of-service condition by crashing the dcpd process. The published CVSS vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating low availability impact and attack feasibility from an adjacent network context. The advisory text describes the attacker as unauthenticated and able to send a malicious packet; however, the CVSS vector suggests proximity to the target network is expected.

Defensive priority

Medium. The impact is denial of service rather than code execution or data compromise, but the affected product is industrial and no vendor fix was available at publication, so mitigation planning should be prompt.

Recommended defensive actions

  • Disable the Profinet Discovery and Configuration Protocol (DCP) service on affected SCALANCE LPE9403 devices if operationally possible.
  • Restrict who can reach the affected device over the local industrial network segment; treat the attack surface as adjacent-network exposure.
  • Monitor for dcpd crashes, unexpected service restarts, and Profinet packet anomalies on affected assets.
  • Apply CISA/Siemens recommended ICS defense-in-depth controls to reduce the blast radius of service-disruption events.
  • Track the Siemens advisory and CISA advisory for any later remediation updates, since the publication listed no fix available at that time.

Evidence notes

Source advisory ICSA-25-135-18 and Siemens CSAF reference the same issue on Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2). The advisory description says incoming Profinet packets are not properly validated and a crafted packet can crash the dcpd process. The remediation section states to disable the Profinet DCP service and notes that no fix is currently available. The published CVSS vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-40577 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-40577

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-40577 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-40577

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-135-18.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-327438.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-327438.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-18

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.