CVE-2025-23403: High severity siemens simatic ipc diagbase firmware vulnerability
A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restrict the user permission for the registry key. This could allow an authenticated attacker to load vulnerable drivers into the system leading to privilege escalation or bypassing endpoint protection and other security measures.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23403?
CVE-2025-23403 is classified as a high-severity vulnerability due to its potential impact on system integrity.
How do I fix CVE-2025-23403?
To remediate CVE-2025-23403, update the affected SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor software to the latest versions provided by Siemens.
What systems are affected by CVE-2025-23403?
CVE-2025-23403 affects all versions of SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor.
What type of attack is possible with CVE-2025-23403?
CVE-2025-23403 could allow authenticated attackers to load vulnerable drivers, leading to potential system exploitation.
Is user authentication sufficient to mitigate CVE-2025-23403?
No, proper restriction of user permissions for the registry key is essential to mitigate CVE-2025-23403, even for authenticated users.