CVE-2025-40743highCWE-288

CVE-2025-40743: high-severity vulnerability in Siemens SINUMERIK 828D PPU.4

Published · Updated

Follow this CVE+ Monitor SINUMERIK 840D sl+ Monitor SINUMERIK ONE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.3%
A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All versions < V4.95 SP5), SINUMERIK MC (All versions < V1.25 SP1), SINUMERIK MC V1.15 (All versions < V1.15 SP5), SINUMERIK ONE (All versions < V6.25 SP1), SINUMERIK ONE V6.15 (All versions < V6.15 SP5). The affected application improperly validates authentication for its VNC access service, allowing access with insufficient password verification. This could allow an attacker to gain unauthorized remote access and potentially compromise system confidentiality, integrity, or availability.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
Siemens · SINUMERIK 828D PPU.4Siemens · SINUMERIK 828D PPU.5Siemens · SINUMERIK 840D slSiemens · SINUMERIK MCSiemens · SINUMERIK MC V1.15Siemens · SINUMERIK ONESiemens · SINUMERIK ONE V6.15
Related CVEs — Siemens SINUMERIK 828D PPU.4

In the same product, most dangerous first.

CVE-2017-12741HIGHCVE-2017-12741EPSS 3.3%CVE-2019-10936HIGHCVE-2019-10936EPSS 2.1%CVE-2020-15783HIGHCVE-2020-15783EPSS 1.7%CVE-2019-10923HIGHCVE-2019-10923EPSS 1.4%CVE-2020-15791MEDIUMCVE-2020-15791EPSS 0.7%CVE-2024-23814MEDIUMCVE-2024-23814EPSS 0.6%