PT-2025-36679 · Siemens · Sinamics S210+2

Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-40594

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SINAMICS G220 versions prior to 6.4 HF2 SINAMICS S200 version 6.4 SINAMICS S210 versions prior to 6.4 HF2

Description: The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management and manipulation of configuration data resulting from leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.

Recommendations: Update SINAMICS G220 to version 6.4 HF2 or later. Update SINAMICS S210 to version 6.4 HF2 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-14337

CVE-2025-40594

Affected Products

Sinamics G220

Sinamics S200

Sinamics S210

References · 6

• https://cert-portal.siemens.com/productcert/html/ssa-027652.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40594 · Security Note
• https://bdu.fstec.ru/vul/2025-14337 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40594 · Vendor Advisory
• https://t.me/CVEtracker/32048 · Telegram Post
• https://twitter.com/CVEnew/status/1965338915612549474 · Twitter Post