ICSA-25-135-18: Siemens SCALANCE LPE9403

CISA's summary

Summary: SCALANCE LPE9403 is affected by multiple vulnerabilities which lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SCALANCE LPE9403 and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2025-40572 — CVE-2025-40572 · CWE-732

  Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to access sensitive information stored on the device.

• CVE-2025-40573 — CVE-2025-40573 · CWE-35

  Affected devices are vulnerable to path traversal attacks. This could allow a privileged local attacker to restore backups that are outside the backup folder.

• CVE-2025-40574 — CVE-2025-40574 · CWE-732

  Affected devices do not properly assign permissions to critical ressources. This could allow a non-privileged local attacker to interact with the backupmanager service.

• CVE-2025-40575 — CVE-2025-40575 · CWE-457

  Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.

• CVE-2025-40576 — CVE-2025-40576 · CWE-476

  Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.

• CVE-2025-40577 — CVE-2025-40577 · CWE-125

  Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.

• CVE-2025-40578 — CVE-2025-40578 · CWE-125

  Affected devices do not properly handle multiple incoming Profinet packets received in rapid succession. An unauthenticated remote attacker can exploit this flaw by sending multiple packets in a very short time frame, which leads to a crash of the dcpd process.

• CVE-2025-40579 — CVE-2025-40579 · CWE-121

  Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition.

• CVE-2025-40580 — CVE-2025-40580 · CWE-121

  Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition.

• CVE-2025-40581 — CVE-2025-40581 · CWE-288

  Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters.

• CVE-2025-40582 — CVE-2025-40582 · CWE-78

  Affected devices do not properly sanitize configuration parameters. This could allow a non-privileged local attacker to execute root commands on the device.

• CVE-2025-40583 — CVE-2025-40583 · CWE-319

  Affected devices do transmit sensitive information in cleartext. This could allow a privileged local attacker to retrieve this sensitive information.

Acknowledgments, as the advisory lists them

• Siemens ProductCERT: reported these vulnerabilities to CISA.
• Luca Borzacchiello, Nozomi Networks: reported these vulnerabilities to Siemens

The advisory's legal notice

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.