How severe is CVE-2023-27408?

CVE-2023-27408 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2023-27408 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-27408?

CVE-2023-27408 affects Siemens Scalance Lpe9403 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-27408?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-27408 published?

CVE-2023-27408 was published on 2023-05-09 and last updated on 2026-06-17.

CVE-2023-27408

CVE-2023-27408 is a low-severity vulnerability in Siemens Scalance Lpe9403 Firmware with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-378.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-378
Affected product: Siemens Scalance Lpe9403 Firmware
Published: 2023-05-09
Last modified: 2026-06-17

Description

A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interface on the affected device to interfere with the integrity of the mutex and the data it protects.

Frequently asked questions

What is CVE-2023-27408?: A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The `i2c` mutex file is created with the permissions bits of `-rw-rw-rw-`. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interface on the affected device to interfere with the integrity of the mutex and the data it protects.
How severe is CVE-2023-27408?: CVE-2023-27408 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2023-27408 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-27408?: CVE-2023-27408 affects Siemens Scalance Lpe9403 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-27408?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-27408 published?: CVE-2023-27408 was published on 2023-05-09 and last updated on 2026-06-17.

References

https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf

Affected products (1)

cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Siemens Scalance Lpe9403 Firmware

CVE-2023-27407 — Critical (CVSS 9.9): A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected…
CVE-2025-27396 — High (CVSS 8.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do…
CVE-2025-40582 — High (CVSS 7.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect…
CVE-2025-40574 — High (CVSS 7.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected…
CVE-2022-0847 — High (CVSS 7.8): A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in…
CVE-2021-4034 — High (CVSS 7.8): A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid…

All CVEs affecting Siemens Scalance Lpe9403 Firmware →

Other CWE-378 vulnerabilities

CVE-2024-39872 — Critical (CVSS 9.6): A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
CVE-2025-32438 — High (CVSS 8.8): make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS…
CVE-2025-27148 — High (CVSS 8.8): Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like…
CVE-2021-29428 — High (CVSS 8.8): In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions…
CVE-2026-33572 — High (CVSS 8.4): OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local…
CVE-2026-4137 — High (CVSS 7.8): In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py`…

Browse all CWE-378 vulnerabilities →