Siemens SCALANCE CVE-2025-40833

Apply vendor-released firmware updates per Siemens Security Advisory SSA-392349 available at https://cert-portal.siemens.com/productcert/html/ssa-392349.html. For SCALANCE networking products, upgrade to firmware version V8.3 or later (applies to M-series routers M804PB/M812/M816/M826/M874/M876/MUB/MUM, S615 routers, RUGGEDCOM RM1224). For SCALANCE W-series wireless access points, upgrade to V6.6.0 or later (W7xx models) or V3.2.0 or later (WAM7xx models). For SIMATIC S7-410 V10 CPU family, upgrade to firmware V10.2 or later. For SIMATIC ET 200SP HA IM155-6 PN, upgrade to V1.3 or later. For SIMATIC CFU devices, upgrade CFU DIQ and CFU PA to V2.0.0 or later. Many affected products (particularly older S7-300/400 CPUs, SINAMICS drives, and various SCALANCE X-series switches) show no upper version bound in EUVD data, indicating patches may not yet be available for all variants - consult Siemens advisory for product-specific remediation status. Compensating controls for unpatched devices: implement strict network segmentation isolating affected industrial devices from untrusted networks using firewalls or VLANs (reduces attack surface but requires network redesign and may complicate remote access), deploy intrusion detection systems monitoring for malformed IPv4 packets targeting affected devices (provides visibility but does not prevent exploitation), restrict IPv4 network access to affected devices using access control lists permitting only known-good IP addresses (effective for static environments but breaks dynamic manufacturing operations), and establish out-of-band management access for rapid recovery after denial-of-service events (mitigates impact of manual restart requirement but does not prevent downtime). Advisory recommends applying cell protection concept and defense-in-depth strategies per Siemens Industrial Security guidelines.