CVE-2025-40753mediumCWE-312

CVE-2025-40753: medium-severity vulnerability in Siemens POWER METER SICAM Q100

Published · Updated

Follow this CVE+ Monitor POWER METER SICAM Q100+ Monitor POWER METER SICAM Q200 family

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.1%
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q200 family (All versions >= V2.70 < V2.80). Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Siemens · POWER METER SICAM Q100Siemens · POWER METER SICAM Q200 family
Related CVEs — Siemens POWER METER SICAM Q100

In the same product, most dangerous first.

CVE-2021-44165—CVE-2021-44165EPSS 2.7%CVE-2022-43546CRITICALCVE-2022-43546EPSS 1.7%CVE-2022-43439CRITICALCVE-2022-43439EPSS 1.7%CVE-2022-43545CRITICALCVE-2022-43545EPSS 1.5%CVE-2022-43398HIGHCVE-2022-43398EPSS 0.5%CVE-2025-40752MEDIUMCVE-2025-40752EPSS 0.1%