VulnerabilityDeferred

CVE-2025-23403

A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions).

HIGH 7.3EPSS 0.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restrict the user permission for the registry key. This could allow an authenticated attacker to load vulnerable drivers into the system leading to privilege escalation or bypassing endpoint protection and other security measures.

CVSS 4.0: 7.3 HIGHCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.15% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-732
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/html/ssa-369369.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.