CVE-2025-40820

Tuesday, December 09, 2025

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

Affected Software

Vendor	Product	Version Range	Status
Siemens	SIDOOR ATD430W	`0 < *`	affected
Siemens	SIDOOR ATE530G COATED	`0 < *`	affected
Siemens	SIDOOR ATE530S COATED	`0 < *`	affected
Siemens	SIMATIC CFU DIQ	`0 < V2.0.0`	affected
Siemens	SIMATIC CFU PA	`0 < V2.0.0`	affected
Siemens	SIMATIC CFU PA	`0 < V2.0.0`	affected
Siemens	SIMATIC ET 200AL IM 157-1 PN	`0 < *`	affected
Siemens	SIMATIC ET 200clean, CM 8x IO-Link	`0 < *`	affected
Siemens	SIMATIC ET 200clean, DI 16x24VDC	`0 < *`	affected
Siemens	SIMATIC ET 200clean, DIQ 16x24VDC/0,5A	`0 < *`	affected
Siemens	SIMATIC ET 200eco PN, AI 8xRTD/TC, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, CM 4x IO-Link, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, DI 16x24VDC, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, DI 8x24VDC, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, DIQ 16x24VDC/2A, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, DQ 8x24VDC/0,5A, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200eco PN, DQ 8x24VDC/2A, M12-L	`V5.1.1 < *`	affected
Siemens	SIMATIC ET 200MP IM 155-5 PN HF	`V4.2.0 < *`	affected
Siemens	SIMATIC ET 200pro IM 154-8 PN/DP CPU	`0 < *`	affected
Siemens	SIMATIC ET 200pro IM 154-8F PN/DP CPU	`0 < *`	affected
Siemens	SIMATIC ET 200pro IM 154-8FX PN/DP CPU	`0 < *`	affected
Siemens	SIMATIC ET 200S IM 151-8 PN/DP CPU	`0 < *`	affected
Siemens	SIMATIC ET 200S IM 151-8F PN/DP CPU	`0 < *`	affected
Siemens	SIMATIC ET 200SP CPU 1510SP F-1 PN	`0 < *`	affected
Siemens	SIMATIC ET 200SP CPU 1510SP-1 PN	`0 < *`	affected
Siemens	SIMATIC ET 200SP CPU 1512SP F-1 PN	`0 < *`	affected
Siemens	SIMATIC ET 200SP CPU 1512SP-1 PN	`0 < *`	affected
Siemens	SIMATIC ET 200SP IM 155-6 MF HF	`0 < *`	affected
Siemens	SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)	`0 < V1.3`	affected
Siemens	SIMATIC ET 200SP IM 155-6 PN HF	`V4.2.0 < *`	affected
Siemens	SIMATIC ET 200SP IM 155-6 PN/2 HF	`V4.2.0 < *`	affected
Siemens	SIMATIC ET 200SP IM 155-6 PN/3 HF	`V4.2.0 < *`	affected
Siemens	SIMATIC PN/MF Coupler	`0 < *`	affected
Siemens	SIMATIC PN/PN Coupler	`0 < V6.0.0`	affected
Siemens	SIMATIC Power Line Booster PLB, Base Module	`0 < *`	affected
Siemens	SIMATIC Power Line Booster PLB, Modem Module ST	`0 < *`	affected
Siemens	SIMATIC S7-1200 CPU 1211C AC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1211C DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1212C AC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1212C DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1212FC DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1214C AC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1214C DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1214FC DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1215C AC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1215C DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1215FC DC/DC/Rly	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1200 CPU 1217C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIMATIC S7-1500 CPU 1511-1 PN	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1511F-1 PN	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1513-1 PN	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1513F-1 PN	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1515-2 PN	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1515F-2 PN	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1516-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-1500 CPU 1516F-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU CR40	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU CR60	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR20	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR20	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR30	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR30	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR40	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR40	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR60	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU SR60	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST20	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST20	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST30	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST30	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST40	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST40	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST60	`0 < *`	affected
Siemens	SIMATIC S7-200 SMART CPU ST60	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 314C-2 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 315-2 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 315F-2 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 315T-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 317-2 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 317F-2 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 317T-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 317TF-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 319-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-300 CPU 319F-3 PN/DP	`0 < *`	affected
Siemens	SIMATIC S7-400 CPU 412-2 PN V7	`0 < *`	affected
Siemens	SIMATIC S7-400 CPU 414-3 PN/DP V7	`0 < *`	affected
Siemens	SIMATIC S7-400 CPU 414F-3 PN/DP V7	`0 < *`	affected
Siemens	SIMATIC S7-400 CPU 416-3 PN/DP V7	`0 < *`	affected
Siemens	SIMATIC S7-400 CPU 416F-3 PN/DP V7	`0 < *`	affected
Siemens	SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)	`0 < *`	affected
Siemens	SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)	`0 < V10.2`	affected
Siemens	SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)	`0 < V8.3`	affected
Siemens	SIMATIC TDC CP51M1	`0 < *`	affected
Siemens	SIMATIC TDC CPU555	`0 < *`	affected
Siemens	SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants)	`0 < *`	affected
Siemens	SIMOCODE pro V PROFINET	`0 < *`	affected
Siemens	SINUMERIK 840D sl	`0 < *`	affected
Siemens	SIPLUS ET 200MP IM 155-5 PN HF	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200MP IM 155-5 PN HF	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200S IM 151-8 PN/DP CPU	`0 < *`	affected
Siemens	SIPLUS ET 200S IM 151-8F PN/DP CPU	`0 < *`	affected
Siemens	SIPLUS ET 200SP CPU 1512SP F-1 PN	`0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL	`V4.2.0 < *`	affected
Siemens	SIPLUS ET 200SP IM 155-6 PN HF TX RAIL	`V4.2.0 < *`	affected
Siemens	SIPLUS HCS4200 CIM4210	`0 < *`	affected
Siemens	SIPLUS HCS4200 CIM4210C	`0 < *`	affected
Siemens	SIPLUS HCS4300 CIM4310	`0 < *`	affected
Siemens	SIPLUS NET PN/PN Coupler	`0 < V6.0.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212 AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212 DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212 DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212C AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214 AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214 DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214C DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1214FC DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215 DC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215C AC/DC/RLY	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215C DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1200 CPU 1215FC DC/DC/DC	`0 < V4.4.0`	affected
Siemens	SIPLUS S7-1500 CPU 1511-1 PN	`0 < *`	affected
Siemens	SIPLUS S7-1500 CPU 1511F-1 PN	`0 < *`	affected
Siemens	SIPLUS S7-1500 CPU 1513-1 PN	`0 < *`	affected
Siemens	SIPLUS S7-1500 CPU 1513F-1 PN	`0 < *`	affected
Siemens	SIPLUS S7-1500 CPU 1516-3 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-1500 CPU 1516-3 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-1500 CPU 1516F-3 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-300 CPU 314C-2 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-300 CPU 315-2 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-300 CPU 315F-2 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-300 CPU 317-2 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-300 CPU 317F-2 PN/DP	`0 < *`	affected
Siemens	SIPLUS S7-400 CPU 414-3 PN/DP V7	`0 < *`	affected
Siemens	SIPLUS S7-400 CPU 416-3 PN/DP V7	`0 < *`	affected
Siemens	SIWAREX WP231	`0 < *`	affected
Siemens	SIWAREX WP241	`0 < *`	affected
Siemens	SIWAREX WP251	`0 < *`	affected
Siemens	SIWAREX WP521 ST	`0 < *`	affected
Siemens	SIWAREX WP522 ST	`0 < *`	affected

Weaknesses

CWE-940: CWE-940: Improper Verification of Source of a Communication Channel

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: yes
- Technical Impact: partial

References

https://cert-portal.siemens.com/productcert/html/ssa-915282.html

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.