CVE-2025-40808Disclosure

LOWCVSS 6.9 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions), SIPROTEC 5 6MD89 (CP300) (All versions), SIPROTEC 5 6MU85 (CP300) (All versions), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions), SIPROTEC 5 7SJ81 (CP100) (All versions), SIPROTEC 5 7SJ81 (CP150) (All versions), SIPROTEC 5 7SJ82 (CP100) (All versions), SIPROTEC 5 7SJ82 (CP150) (All versions), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions), SIPROTEC 5 7SK82 (CP100) (All versions), SIPROTEC 5 7SK82 (CP150) (All versions), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions), SIPROTEC 5 7ST86 (CP300) (All versions), SIPROTEC 5 7SX82 (CP150) (All versions), SIPROTEC 5 7SX85 (CP300) (All versions), SIPROTEC 5 7SY82 (CP150) (All versions), SIPROTEC 5 7UM85 (CP300) (All versions), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions), SIPROTEC 5 7VE85 (CP300) (All versions), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions), SIPROTEC 5 7VU85 (CP300) (All versions), SIPROTEC 5 Compact 7SX800 (CP050) (All versions). The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

https://cert-portal.siemens.com/productcert/html/ssa-139483.html

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
3 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-09); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Disclosure

133.3%

General

133.3%

Active Exploitation

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	2	Disclosure1General1
2026-06-23	1	Active Exploitation1

Full discourse3 posts

Aviatrix Threat Research Center@aviatrixtrc123d
Active Exploitation
TRC analysis shows attackers exploited CVE-2025-40808 in Siemens SIPROTEC 5 devices by uploading malicious configuration files via DIGSI 5 protocol. Post-compromise lateral movement across industrial networks demonstrates how initial access can cascade through critical infrastructure. Runtime segmentation helps contain breach chains in OT environments. #CriticalInfrastructure 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/icsa-26-174-02-cve-2025-40808
Post summary
Attackers have leveraged CVE-2025-40808 on Siemens SIPROTEC 5 devices by uploading malicious configuration files through the DIGSI 5 protocol, enabling lateral movement across industrial networks.
0000047
1.9K followersView on X
Infoflowcloud@infoflowcloud137d
General
🚨*CVE* CVE-2025-40808 A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPR… https://www.cve.org/CVERecord?id=CVE-2025-40808 ----- Traducción: CVE-2025-40808 Se … http://infoflow.cloud`
Post summary
The post announces the existence of CVE-2025-40808 and lists affected SIPROTEC models, but it lacks technical specifics, proof-of-concept details, or evidence of active exploitation.
0000021
79 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2025-40808 A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPR… https://www.cve.org/CVERecord?id=CVE-2025-40808
Post summary
The text merely announces that a vulnerability (CVE‑2025‑40808) has been identified in certain SIPROTEC models, without providing exploitation details, PoC, patch information, or evidence of active use.
00000166
57.6K followersView on X

Explore more

Back to dashboard