Vulnerability · Published Mar 11, 2025 · Assigned by siemens
CVE-2025-27397
Low 3.8
In plain English
A low-severity path traversal in SCALANCE LPE9403 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write arbitrary files in the filesystem, if and only if the malicious path ends with 'log' .
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SCALANCE LPE9403 | 0 – before V4.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C