CVE-2025-40943

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-06-17
Weakness: CWE-95

Description

Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering an authorized user, who has the function right "Read diagnostics", to import a specially crafted trace file. The malicious trace file is insufficiently sanitized and malicious code could be executed in the clients browser session and trigger PLC operations via the webserver that the legitimate user is authorized to perform.

Affected products

Siemens SIMATIC Drive Controller CPU 1504D TF: before V3.1.6 — fixed in V3.1.6
Siemens SIMATIC Drive Controller CPU 1507D TF: before V3.1.6 — fixed in V3.1.6
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN: before V4.1.2 — fixed in V4.1.2
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN: before V4.1.2 — fixed in V4.1.2
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN: before V4.1.2 — fixed in V4.1.2
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN: before V4.1.2 — fixed in V4.1.2
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUs: all versions
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants): all versions
Siemens SIMATIC S7-1500 CPU 1511-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1511C-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1511F-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1511T-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1511TF-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1512C-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1513-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1513F-1 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1513pro-2 PN: before V4.1.2 — fixed in V4.1.2
Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN: before V4.1.2 — fixed in V4.1.2
Siemens SIMATIC S7-1500 CPU 1515-2 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1515F-2 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1515T-2 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1515TF-2 PN: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2
Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP: before V2.9.9; before V4.1.2 — fixed in V2.9.9, V4.1.2

How to fix

Upgrade to a fixed version: Siemens SIMATIC Drive Controller CPU 1504D TF V3.1.6; Siemens SIMATIC Drive Controller CPU 1507D TF V3.1.6; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN V2.9.9, V4.1.2; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN V2.9.9, V4.1.2; Siemens SIMATIC ET 200SP CPU 1512SP-1 PN V2.9.9, V4.1.2; Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN V2.9.9, V4.1.2; Siemens SIMATIC ET 200SP CPU 1514SP-2 PN V4.1.2; Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN V4.1.2; Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN V4.1.2; Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN V4.1.2; Siemens SIMATIC S7-1500 CPU 1511-1 PN V2.9.9, V4.1.2; Siemens SIMATIC S7-1500 CPU 1511C-1 PN V2.9.9, V4.1.2. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-452276.html

Get alerted when CVE-2025-40943 or the next vulnerability affects your stack