How severe is CVE-2025-40575?

CVE-2025-40575 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-40575 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-40575?

CVE-2025-40575 affects Siemens Scalance Lpe9403 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-40575?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-40575 have an EU (EUVD) identifier?

Yes. CVE-2025-40575 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14671.

When was CVE-2025-40575 published?

CVE-2025-40575 was published on 2025-05-13 and last updated on 2026-06-17.

CVE-2025-40575

CVE-2025-40575 is a medium-severity vulnerability in Siemens Scalance Lpe9403 Firmware with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-457.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v4: 5.3
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-14671
Weakness: CWE-457
Affected product: Siemens Scalance Lpe9403 Firmware
Published: 2025-05-13
Last modified: 2026-06-17

Description

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.

Frequently asked questions

What is CVE-2025-40575?: A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.
How severe is CVE-2025-40575?: CVE-2025-40575 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-40575 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-40575?: CVE-2025-40575 affects Siemens Scalance Lpe9403 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-40575?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-40575 have an EU (EUVD) identifier?: Yes. CVE-2025-40575 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14671.
When was CVE-2025-40575 published?: CVE-2025-40575 was published on 2025-05-13 and last updated on 2026-06-17.

References

https://cert-portal.siemens.com/productcert/html/ssa-327438.html

Affected products (1)

cpe:2.3:o:siemens:scalance_lpe9403_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Siemens Scalance Lpe9403 Firmware

CVE-2023-27407 — Critical (CVSS 9.9): A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected…
CVE-2025-27396 — High (CVSS 8.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do…
CVE-2025-40582 — High (CVSS 7.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect…
CVE-2025-40574 — High (CVSS 7.8): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected…
CVE-2022-0847 — High (CVSS 7.8): A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in…
CVE-2021-4034 — High (CVSS 7.8): A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid…

All CVEs affecting Siemens Scalance Lpe9403 Firmware →

Other CWE-457 vulnerabilities

CVE-2026-6748 — Critical (CVSS 9.8): Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR…
CVE-2025-54874 — Critical (CVSS 9.8): OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may…
CVE-2025-53644 — Critical (CVSS 9.8): OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on…
CVE-2026-14405 — Critical (CVSS 9.6): Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code…
CVE-2026-13825 — High (CVSS 8.8): Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap…
CVE-2025-5749 — High (CVSS 8.8): WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This…

Browse all CWE-457 vulnerabilities →