CVE-2025-40816
Summary
| CVE | CVE-2025-40816 |
|---|---|
| State | PUBLISHED |
| Assigner | siemens |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-11-11 21:15:38 UTC |
| Updated | 2026-10-13 10:17:13 UTC |
| Description | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions < V1.84.05), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions < V1.84.05), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions < V1.84.05), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions < V1.84.05), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions < V1.84.05), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions < V1.84.05). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable. |
Risk And Classification
Primary CVSS: v4.0 7.2 HIGH from [email protected]
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-306 | CWE-306 CWE-306: Missing Authentication for Critical Function
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.2 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 7.2 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 7.6 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
| 3.1 | CNA | DECLARED | 7.6 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
LowIntegrity
LowAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Siemens | LOGO! 12/24RCE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 12/24RCEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 230RCE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 230RCEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 24CE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 24CEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 24RCE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | LOGO! 24RCEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 12/24RCE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 12/24RCEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 230RCE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 230RCEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 24CE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 24CEo | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 24RCE | affected V1.84.05 custom | Not specified |
| CNA | Siemens | SIPLUS LOGO! 24RCEo | affected V1.84.05 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/html/ssa-267056.html | [email protected] | cert-portal.siemens.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.