What is the CVSS score of CVE-2025-27397?

CVE-2025-27397 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Siemens are affected by CVE-2025-27397?

CVE-2025-27397 is a low-severity vulnerability in A vulnerability involving path traversal (CVSS 3.8).

How to fix or mitigate CVE-2025-27397?

During next maintenance window: Apply vendor patches when convenient. Verify path traversal controls are in place.

Siemens CVE-2025-27397

LOW

Path Traversal (CWE-22)

2025-03-11 productcert@siemens.com

Path Traversal Siemens

3.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:52 vuln.today

CVE Published

Mar 11, 2025 - 10:15 nvd

LOW 3.8

DescriptionCVE.org

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write arbitrary files in the filesystem, if and only if the malicious path ends with 'log' .

AnalysisAI

Technical ContextAI

Classified as CWE-22 (Path Traversal). A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write arbitrary files in the filesystem, if and only if the malicious path ends with 'log' .

Affected ProductsAI

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0)

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.