How severe is CVE-2023-27409?

CVE-2023-27409 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2023-27409 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-27409?

CVE-2023-27409 affects Siemens Scalance Lpe9403 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-27409?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-27409 published?

CVE-2023-27409 was published on 2023-05-09 and last updated on 2026-06-17.

CVE-2023-27409

CVE-2023-27409 is a low-severity vulnerability in Siemens Scalance Lpe9403 Firmware with a CVSS 3.x base score of 2.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

Severity: Low (CVSS 3.x base score 2.5)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-22
Affected product: Siemens Scalance Lpe9403 Firmware
Published: 2023-05-09
Last modified: 2026-06-17

Description

A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vulnerability was found in the `deviceinfo` binary via the `mac` parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file named `address`.

Frequently asked questions

What is CVE-2023-27409?: A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vulnerability was found in the `deviceinfo` binary via the `mac` parameter. This could allow an authenticated attacker with access to the SSH interface on the affected device to read the contents of any file named `address`.
How severe is CVE-2023-27409?: CVE-2023-27409 has a CVSS 3.x base score of 2.5, rated low severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2023-27409 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-27409?: CVE-2023-27409 affects Siemens Scalance Lpe9403 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-27409?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-27409 published?: CVE-2023-27409 was published on 2023-05-09 and last updated on 2026-06-17.

References

https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf

Affected products (1)

cpe:2.3:o:siemens:scalance_lpe9403_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Siemens Scalance Lpe9403 Firmware

CVE-2023-27407 — Critical (CVSS 9.9): A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected…
CVE-2025-27396 — High (CVSS 8.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do…
CVE-2025-40582 — High (CVSS 7.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA…
CVE-2025-40574 — High (CVSS 7.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected…
CVE-2022-0847 — High (CVSS 7.8): A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in…
CVE-2021-4034 — High (CVSS 7.8): A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid…

All CVEs affecting Siemens Scalance Lpe9403 Firmware →

Other CWE-22 (Path Traversal) vulnerabilities

CVE-2026-55393 — Critical (CVSS 10.0): Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9…
CVE-2026-97163 — Critical (CVSS 10.0): Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
CVE-2026-80155 — Critical (CVSS 10.0): Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,…
CVE-2026-70200 — Critical (CVSS 10.0): Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an…
CVE-2026-85706 — Critical (CVSS 10.0): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9,…
CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.

Browse all CWE-22 (Path Traversal) vulnerabilities →