PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-40742 Siemens CVE debrief

CVE-2025-40742 affects a broad set of Siemens SIPROTEC 5 and Compact 7SX800 devices. The issue is that some device functions place session identifiers in URL requests, which can expose those identifiers through browser history, logs, or other storage mechanisms. If an attacker obtains such data, it could contribute to unauthorized access. The CVE was published on 2025-07-08 and last modified on 2026-05-12.

Vendor
Siemens
Product
SIPROTEC 5 6MD84 (CP300)
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-07-08
Original CVE updated
2026-05-14
Advisory published
2025-07-08
Advisory updated
2026-05-14

Who should care

OT security teams, substation and grid operators, protection relay administrators, Siemens SIPROTEC 5 customers, and anyone responsible for monitoring logs, browser artifacts, or remote access workflows involving these devices.

Technical summary

NVD classifies the weakness as CWE-598 (Information Exposure Through Query Strings in GET Request), with a CVSS v4.0 score of 6.0 (Medium). The supplied record describes affected SIPROTEC 5 models and notes that session identifiers are included in URL requests for certain functionalities. Because URLs can be preserved in browser history, proxy records, web server logs, and similar storage, those identifiers may be retrievable by an attacker with access to such artifacts. NVD lists the vulnerability status as Deferred in the supplied metadata.

Defensive priority

Medium. This is not marked as known exploited in the supplied corpus, but it affects many operational devices and can expose credentials or session material indirectly through routine logging and history artifacts.

Recommended defensive actions

  • Review the Siemens advisory referenced by NVD for the exact affected model and version combinations.
  • Identify whether any SIPROTEC 5 management or service workflows in your environment pass session identifiers in URLs.
  • Check for logging, proxying, or browser-history retention that could preserve sensitive URL parameters.
  • Limit access to operational logs and workstation/browser artifacts that may contain session data.
  • Apply vendor guidance or firmware updates when available, especially for versions listed as below V11.0 in the supplied record.
  • Invalidate and rotate any session material that may have been exposed in logs or history.
  • Prefer authentication and session handling patterns that do not place identifiers in URLs where operationally possible.

Evidence notes

Evidence is limited to the supplied CVE record and NVD metadata. The record states that affected devices include session identifiers in URL requests for certain functionalities and that this can expose sensitive session data via browser history, logs, or other storage mechanisms. NVD supplies CWE-598, CVSS 4.0 vector details, publication date 2025-07-08, modification date 2026-05-12, and a reference to Siemens advisory SSA-904646. No additional advisory text was supplied here.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-40742 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-40742

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-40742 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-40742

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-191-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-904646.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-904646.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.