Siemens Vulnerabilities and Affected Products
Vulnerabilities associated with SiPass integrated.
Products
Clear product- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP569 vulnerabilities
- SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP569 vulnerabilities
- SIPLUS S7-1500 CPU 1518-4 PN/DP MFP569 vulnerabilities
- SIMATIC S7-1500 TM MFP - GNU/Linux subsystem455 vulnerabilities
- RUGGEDCOM RST2428P276 vulnerabilities
- SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family197 vulnerabilities
- SIMATIC CN 4100186 vulnerabilities
- SCALANCE XCM-/XRM-/XCH-/XRH-300 family179 vulnerabilities
- JT2Go153 vulnerabilities
- Teamcenter Visualization93 vulnerabilities
- RUGGEDCOM APE180880 vulnerabilities
- RUGGEDCOM ROX MX500078 vulnerabilities
- RUGGEDCOM ROX RX140078 vulnerabilities
- RUGGEDCOM ROX RX150078 vulnerabilities
- RUGGEDCOM ROX RX150178 vulnerabilities
- RUGGEDCOM ROX RX151078 vulnerabilities
- RUGGEDCOM ROX RX151178 vulnerabilities
- RUGGEDCOM ROX RX151278 vulnerabilities
- RUGGEDCOM ROX RX152478 vulnerabilities
- RUGGEDCOM ROX RX153678 vulnerabilities
- RUGGEDCOM ROX RX500078 vulnerabilities
- Tecnomatix Plant Simulation V230275 vulnerabilities
- RUGGEDCOM ROX MX5000RE74 vulnerabilities
- TeleControl Server Basic70 vulnerabilities
- SINEC NMS68 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-40774MEDIUM | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users with administrative privileges, allowing them to recover passwords. Successful exploitation of this vulnerability allows an attacker to obtain and use valid user passwords. This can lead to unauthorized access to user accounts, data breaches, and potential system compromise. CWE-257Oct 14, 2025 | CVSS6.7v4.0 | EPSS0.127% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-40773MEDIUM | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request. Successful exploitation allows an attacker to potentially manipulate data belonging to other users. CWE-639Oct 14, 2025 | CVSS5.1v4.0 | EPSS0.182% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-40772HIGH | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation allows an attacker to impersonate other users within the application and steal their session data. This could enable unauthorized access to accounts and potentially lead to privilege escalation. CWE-79Oct 14, 2025 | CVSS7.0v4.0 | EPSS0.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-31812HIGH | A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds read past the end of an allocated buffer while checking the integrity of incoming packets. This could allow an unauthenticated remote attacker to create a denial of service condition. CWE-125May 23, 2025 | CVSS8.7v4.0 | EPSS0.596% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-31810HIGH | A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size of data packets received for the configuration client login, causing a stack-based buffer overflow. This could allow an unauthenticated remote attacker to crash the server application, creating a denial of service condition. | CVSS7.5v3.1 | EPSS0.879% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |