CVE-2025-40576

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash of the dcpd process.

Score

CVSS 4.0 5.3 Medium

Status

Modified - productcert@siemens.com

Published

2025-05-13

Last modified

2025-07-08

Weaknesses

CWE-476

Affected products

• Scalance Lpe9403 (Siemens)
• Scalance Lpe9403 Firmware (Siemens)

References

• https://cert-portal.siemens.com/productcert/html/ssa-327438.html