Vulnerability · Published Sep 9, 2025 · Assigned by siemens
CVE-2025-40594
Medium 6.3
In plain English
A medium-severity privilege mismanagement in SINAMICS G220 V6.4 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINAMICS G220 V6.4 | 0 – before V6.4 HF2 |
| Siemens | SINAMICS S200 V6.4 | 0 – before V6.4 HF7 |
| Siemens | SINAMICS S210 V6.4 | 0 – before V6.4 HF2 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L