CVE-2025-40833

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-08-11
Weakness: CWE-476

Description

The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual restart is required to recover the system.

Affected products

Siemens IE/PB LINK HA: before V4.1.2 — fixed in V4.1.2
Siemens IE/PB link PN IO: all versions
Siemens RUGGEDCOM RM1224 LTE(4G) EU: before V8.3 — fixed in V8.3
Siemens RUGGEDCOM RM1224 LTE(4G) NAM: before V8.3 — fixed in V8.3
Siemens SCALANCE M804PB: before V8.3 — fixed in V8.3
Siemens SCALANCE M812-1 ADSL-Router: before V8.3 — fixed in V8.3
Siemens SCALANCE M816-1 ADSL-Router: before V8.3 — fixed in V8.3
Siemens SCALANCE M826-2 SHDSL-Router: before V8.3 — fixed in V8.3
Siemens SCALANCE M874-2: before V8.3 — fixed in V8.3
Siemens SCALANCE M874-3: before V8.3 — fixed in V8.3
Siemens SCALANCE M874-3 3G-Router (CN): before V8.3 — fixed in V8.3
Siemens SCALANCE M876-3: before V8.3 — fixed in V8.3
Siemens SCALANCE M876-3 (ROK): before V8.3 — fixed in V8.3
Siemens SCALANCE M876-4: before V8.3 — fixed in V8.3
Siemens SCALANCE M876-4 (EU): before V8.3 — fixed in V8.3
Siemens SCALANCE M876-4 (NAM): before V8.3 — fixed in V8.3
Siemens SCALANCE MUB852-1 (A1): before V8.3 — fixed in V8.3
Siemens SCALANCE MUB852-1 (B1): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM853-1 (A1): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM853-1 (B1): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM853-1 (EU): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM856-1 (A1): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM856-1 (B1): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM856-1 (CN): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM856-1 (EU): before V8.3 — fixed in V8.3
Siemens SCALANCE MUM856-1 (RoW): before V8.3 — fixed in V8.3
Siemens SCALANCE S615 EEC LAN-Router: before V8.3 — fixed in V8.3
Siemens SCALANCE S615 LAN-Router: before V8.3 — fixed in V8.3
Siemens SCALANCE SC622-2C: before V3.2 — fixed in V3.2
Siemens SCALANCE SC626-2C: before V3.2 — fixed in V3.2

How to fix

Upgrade to a fixed version: Siemens IE/PB LINK HA V4.1.2; Siemens RUGGEDCOM RM1224 LTE(4G) EU V8.3; Siemens RUGGEDCOM RM1224 LTE(4G) NAM V8.3; Siemens SCALANCE M804PB V8.3; Siemens SCALANCE M812-1 ADSL-Router V8.3; Siemens SCALANCE M816-1 ADSL-Router V8.3; Siemens SCALANCE M826-2 SHDSL-Router V8.3; Siemens SCALANCE M874-2 V8.3; Siemens SCALANCE M874-3 V8.3; Siemens SCALANCE M874-3 3G-Router (CN) V8.3; Siemens SCALANCE M876-3 V8.3; Siemens SCALANCE M876-3 (ROK) V8.3. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-392349.html

Get alerted when CVE-2025-40833 or the next vulnerability affects your stack