EUVD-2025-209778
GHSA-9483-pcvr-wj53
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network access to OT segment
-
DeliveryCraft malformed IPv4 packets
-
ExploitSend to vulnerable Siemens device
-
ExecutionTrigger null pointer dereference
-
ImpactDevice crashes requiring manual restart
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote network access to affected Siemens devices via IPv4 protocol - no authentication, user interaction, or non-default configuration required (AV:N/AC:L/PR:N/UI:N indicates exploitation against default configurations). Exploitation limited by network accessibility: devices on isolated OT networks behind firewalls or network segmentation require attacker presence on same network segment or compromise of adjacent systems. The low attack complexity suggests standard IPv4 packet crafting without protocol-specific exploitation techniques. Devices directly exposed to untrusted networks (internet, corporate IT networks without OT segmentation, vendor remote access connections) face immediate exploitation risk from remote unauthenticated attackers. Well-segmented industrial networks where affected devices communicate only with known automation systems via managed switches substantially reduce practical exploitability despite theoretical remote vector. |
| Impact | Real-world risk assessment presents a nuanced picture requiring careful evaluation. The CVSS 4.0 score of 8.7 primarily reflects maximum availability impact (VA:H) with an ideal attack vector (AV:N/AC:L/PR:N/UI:N), indicating remote unauthenticated denial of service. However, multiple mitigating factors temper urgency: no CISA KEV listing confirms active exploitation, no public proof-of-concept code exists, and EPSS data is not provided but likely low given the specialized industrial target environment. The SSVC framework suggests medium priority - while the vulnerability is technically exploitable remotely without authentication, the automatable aspect depends on network accessibility, and real-world OT environments typically implement defense-in-depth with network segmentation isolating industrial devices. The critical consideration is operational context: for facilities where affected SCALANCE switches provide primary network connectivity or SIMATIC PLCs control safety-critical processes, a denial-of-service requiring manual restart could cause production downtime or safety implications exceeding the pure technical severity. The 200+ affected product variants across PLCs, drives, switches, and routers indicate widespread deployment potential in manufacturing, energy, and critical infrastructure sectors. Priority should escalate for internet-exposed devices or environments lacking network segmentation, while well-segmented OT networks with compensating monitoring controls face lower immediate risk. The straightforward attack vector (crafted IPv4 packets) and lack of required privileges make automated scanning and exploitation plausible once attack details emerge. |
| Exploit ScenarioDerived | An attacker on the same network segment as vulnerable Siemens industrial devices crafts malicious IPv4 packets targeting the affected protocol stack implementation. The attacker sends these specially formatted packets to a SCALANCE switch providing connectivity for a manufacturing line or to a SIMATIC PLC controlling production equipment. The malformed IPv4 request triggers a null pointer dereference in packet processing code, causing immediate device crash and loss of network connectivity or control functionality. Affected devices require manual physical restart by operations personnel, resulting in unplanned production downtime. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – May 12, 2026
Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected devices via specially crafted IPv4 packets, requiring manual restart for recovery. This vulnerability affects over 200 Siemens industrial automation products including SCALANCE switches/routers, SIMATIC PLCs, SINAMICS drives, and RUGGEDCOM devices. CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network-accessible attack vector requiring low complexity and no privileges (AV:N/AC:L/PR:N). No public exploit code or CISA KEV listing identified at time of analysis, though the straightforward network-based attack and widespread product exposure warrant priority patching for operational technology environments where uptime is critical.
Earlier versions of this analysis (1)
Null pointer dereference in Siemens PROFINET devices allows remote unauthenticated denial of service via specially crafted IPv4 packets. Affects extensive portfolio of industrial networking equipment including SCALANCE switches/routers, RUGGEDCOM devices, SIMATIC PLCs, and SINAMICS drives. Crashed devices require manual restart, creating operational disruption risk in industrial control environments. CVSS 7.5 (High) with EPSS data unavailable - real-world impact depends on network segmentation and exposure of affected PROFINET infrastructure to untrusted networks.
RemediationAI
Apply vendor-released firmware updates per Siemens Security Advisory SSA-392349 available at https://cert-portal.siemens.com/productcert/html/ssa-392349.html. For SCALANCE networking products, upgrade to firmware version V8.3 or later (applies to M-series routers M804PB/M812/M816/M826/M874/M876/MUB/MUM, S615 routers, RUGGEDCOM RM1224). For SCALANCE W-series wireless access points, upgrade to V6.6.0 or later (W7xx models) or V3.2.0 or later (WAM7xx models). For SIMATIC S7-410 V10 CPU family, upgrade to firmware V10.2 or later. For SIMATIC ET 200SP HA IM155-6 PN, upgrade to V1.3 or later. For SIMATIC CFU devices, upgrade CFU DIQ and CFU PA to V2.0.0 or later. Many affected products (particularly older S7-300/400 CPUs, SINAMICS drives, and various SCALANCE X-series switches) show no upper version bound in EUVD data, indicating patches may not yet be available for all variants - consult Siemens advisory for product-specific remediation status. Compensating controls for unpatched devices: implement strict network segmentation isolating affected industrial devices from untrusted networks using firewalls or VLANs (reduces attack surface but requires network redesign and may complicate remote access), deploy intrusion detection systems monitoring for malformed IPv4 packets targeting affected devices (provides visibility but does not prevent exploitation), restrict IPv4 network access to affected devices using access control lists permitting only known-good IP addresses (effective for static environments but breaks dynamic manufacturing operations), and establish out-of-band management access for rapid recovery after denial-of-service events (mitigates impact of manual restart requirement but does not prevent downtime). Advisory recommends applying cell protection concept and defense-in-depth strategies per Siemens Industrial Security guidelines.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from a null pointer dereference (CWE-476) in IPv4 packet processing code shared across Siemens industrial automation platforms. The affected CPE strings span SCALANCE industrial Ethernet switches (M-series routers, X-series switches, W-series wireless), SIMATIC programmable logic controllers (S7-300/400/1500 series CPUs), SINAMICS motor drives (G120/G130/S120/S150), RUGGEDCOM ruggedized networking equipment, IE/PB communication links, and SITOP industrial power supplies with embedded networking. A null pointer dereference occurs when software attempts to access memory through a pointer that has not been properly initialized or validated, causing immediate process termination. In network protocol stacks, this typically happens when malformed packets trigger edge cases in parsing logic where expected data structures are absent. The vulnerability affects firmware versions prior to V8.3 in networking products and unpatched versions across the PLC/drive product lines, suggesting a common networking stack component shared across Siemens industrial portfolio. The network-accessible nature (AV:N) and lack of authentication requirement (PR:N) make this particularly concerning for industrial control systems that often have limited segmentation.
Know when Scalance X308 2M gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (siemens) · only source for this CVE.
CVSS VectorVendor: siemens
Lifecycle Timeline
3DescriptionCVE.org
The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual restart is required to recover the system.
Executive ViewAI
CVE-2025-40833 is a high-severity denial-of-service vulnerability affecting over 200 Siemens industrial automation products (SCALANCE, SIMATIC, SINAMICS, RUGGEDCOM) that allows unauthenticated remote attackers to crash devices via malformed network packets, requiring manual restart for recovery. Organizations operating Siemens industrial control systems face potential production downtime and safety risks until mitigations are deployed, as affected devices are network-accessible without authentication requirements.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-based ingress filtering and rate-limiting on firewall/IDS to block malformed IPv4 packets before reaching industrial devices; (2) Isolate affected Siemens devices on segmented OT networks with restricted external connectivity; (3) Deploy network anomaly detection tuned to industrial protocols; (4) Establish rapid device restart procedures and redundant control system configurations where operationally feasible to minimize uptime impact; (5) Monitor Siemens security advisories for patch releases and vendor-provided technical guidance on packet signatures/blocking rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB