CVE-2025-40820

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-09 · updated 2026-10-07
Weakness: CWE-940

Description

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

Affected products

Siemens SIDOOR ATD430W: all versions
Siemens SIDOOR ATE530G COATED: all versions
Siemens SIDOOR ATE530S COATED: all versions
Siemens SIMATIC CFU DIQ: before V2.0.0 — fixed in V2.0.0
Siemens SIMATIC CFU PA: before V2.0.0 — fixed in V2.0.0
Siemens SIMATIC ET 200AL IM 157-1 PN: all versions
Siemens SIMATIC ET 200clean, CM 8x IO-Link: all versions
Siemens SIMATIC ET 200clean, DI 16x24VDC: all versions
Siemens SIMATIC ET 200clean, DIQ 16x24VDC/0,5A: all versions
Siemens SIMATIC ET 200eco PN, AI 8xRTD/TC, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, CM 4x IO-Link, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, DI 16x24VDC, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, DI 8x24VDC, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, DIQ 16x24VDC/2A, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, DQ 8x24VDC/0,5A, M12-L: from V5.1.1
Siemens SIMATIC ET 200eco PN, DQ 8x24VDC/2A, M12-L: from V5.1.1
Siemens SIMATIC ET 200MP IM 155-5 PN HF: from V4.2.0
Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU: all versions
Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU: all versions
Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU: all versions
Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU: all versions
Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU: all versions
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: all versions
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: all versions
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: all versions
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: all versions
Siemens SIMATIC ET 200SP IM 155-6 MF HF: all versions
Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF: from V4.2.0
Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF: from V4.2.0

How to fix

Upgrade to a fixed version: Siemens SIMATIC CFU DIQ V2.0.0; Siemens SIMATIC CFU PA V2.0.0; Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) V1.3; Siemens SIMATIC PN/PN Coupler V6.0.0; Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly V4.4.0; Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC V4.4.0; Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly V4.4.0; Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly V4.4.0; Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC V4.4.0; Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly V4.4.0; Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC V4.4.0; Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly V4.4.0. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-915282.html

Get alerted when CVE-2025-40820 or the next vulnerability affects your stack