PT-2025-41884 · Unknown · Sipass Integrated

Published 2025-10-14 · Updated 2025-10-14 · CVE-2025-40772

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiPass integrated versions prior to 3.0

Description The SiPass integrated server applications are susceptible to stored Cross-Site Scripting (XSS). Successful exploitation enables an attacker to inject malicious code that executes in other users' browsers when they access the affected page. This can lead to impersonation of other users and theft of session data, potentially resulting in unauthorized access and privilege escalation.

Recommendations Update SiPass integrated to version 3.0 or later.

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40772

Affected Products

Sipass Integrated

References · 6

• https://cert-portal.siemens.com/productcert/html/ssa-599451.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40772 · Security Note
• https://twitter.com/CVEnew/status/1978032046850166871 · Twitter Post
• https://t.me/CVEtracker/34850 · Telegram Post
• https://twitter.com/CveTodo/status/1978047645550583950 · Twitter Post