Vulnerability · Published Aug 12, 2025 · Assigned by siemens

CVE-2025-40751

Medium 6.3

In plain English

A medium-severity security flaw in SIMATIC RTLS Locating Manager from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.1%top 97.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.

Affected products (as reported)

Vendor	Product	Versions
Siemens	SIMATIC RTLS Locating Manager	0 – before V3.3

Weakness: CWE-522 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://cert-portal.siemens.com/productcert/html/ssa-707630.html