PT-2025-24677 · Siemens · Scalance Xr326-8+20

Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-40569

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:H/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions RUGGEDCOM RST2428P versions prior to V3.2 SCALANCE XC316-8 versions prior to V3.2 SCALANCE XC324-4 versions prior to V3.2 SCALANCE XC324-4 EEC versions prior to V3.2 SCALANCE XC332 versions prior to V3.2 SCALANCE XC416-8 versions prior to V3.2 SCALANCE XC424-4 versions prior to V3.2 SCALANCE XC432 versions prior to V3.2 SCALANCE XCH328 versions prior to V3.2 SCALANCE XCM324 versions prior to V3.2 SCALANCE XCM328 versions prior to V3.2 SCALANCE XCM332 versions prior to V3.2 SCALANCE XR302-32 versions prior to V3.2 SCALANCE XR322-12 versions prior to V3.2 SCALANCE XR326-8 versions prior to V3.2 SCALANCE XR326-8 EEC versions prior to V3.2 SCALANCE XR502-32 versions prior to V3.2 SCALANCE XR522-12 versions prior to V3.2 SCALANCE XR526-8 versions prior to V3.2 SCALANCE XRH334 versions prior to V3.2 SCALANCE XRM334 versions prior to V3.2

Description A race condition vulnerability has been identified in the "Load Configuration from Local PC" functionality in the web interface of affected products. This could allow an authenticated remote attacker to make the affected product load an attacker-controlled configuration instead of the legitimate one. Successful exploitation requires that a legitimate administrator invokes the functionality and the attacker wins the race condition.

Recommendations For all affected versions, update to version V3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Load Configuration from Local PC" functionality in the web interface until a patch is available.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2025-10418

CVE-2025-40569

Affected Products

Ruggedcom Rst2428P

Scalance Xc316-8

Scalance Xc324-4

Scalance Xr324-4M Eec

Scalance Xc332

Scalance Xc416-8

Scalance Xc424-4

Scalance Xc432

Scalance Xch328

Scalance Xcm324

Scalance Xcm328

Scalance Xcm332

Scalance Xr302-32

Scalance Xr322-12

Scalance Xr326-8

Scalance Xr326-8 Eec

Scalance Xr502-32

Scalance Xr522-12

Scalance Xr526-8C

Scalance Xrh334

Scalance Xrm334

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-40569 · Security Note
• https://bdu.fstec.ru/vul/2025-10418 · Security Note
• https://twitter.com/CVEnew/status/1932465950583882120 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-693776.html · Note