Vulnerability · Published Aug 12, 2025 · Assigned by siemens
CVE-2025-40753
Medium 6.2
In plain English
A medium-severity security flaw in POWER METER SICAM Q100 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q200 family (All versions >= V2.70 < V2.80). Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | POWER METER SICAM Q100 | V2.60 – before V2.62 |
| Siemens | POWER METER SICAM Q100 | V2.60 – before V2.62 |
| Siemens | POWER METER SICAM Q100 | V2.60 – before V2.62 |
| Siemens | POWER METER SICAM Q100 | V2.60 – before V2.62 |
| Siemens | POWER METER SICAM Q200 family | V2.70 – before V2.80 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N