CVE-2025-40771: Critical severity Siemens SIMATIC CP 1542SP-1 vulnerability
A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.4.24). Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40771?
CVE-2025-40771 is classified as a high severity vulnerability due to its potential impact on device integrity and security.
How do I fix CVE-2025-40771?
To fix CVE-2025-40771, upgrade the affected devices to versions equal to or greater than V2.4.24.
Which products are affected by CVE-2025-40771?
CVE-2025-40771 affects several Siemens products, including SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, and SIMATIC CP 1543SP-1, all versions below V2.4.24.
What are the consequences of not addressing CVE-2025-40771?
Failing to address CVE-2025-40771 can lead to unauthorized access or control over the affected Siemens devices.
Is CVE-2025-40771 a remote exploit vulnerability?
Yes, CVE-2025-40771 can be exploited remotely, allowing attackers to compromise system functionality without physical access.