Siemens SIPROTEC 5 6MD84 (CP300)

CVE-2025-40742
MEDIUM 6.0

En bref

Source
NVD
EPSS
EPSS 0.32 % · centile 25 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
siemens
Statut NVD
Deferred

Description

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions < V11.0), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions < V11.0), SIPROTEC 5 6MD89 (CP300) (All versions < V11.0), SIPROTEC 5 6MD89 (CP300) V9.6x (All versions < V11.0), SIPROTEC 5 6MU85 (CP300) (All versions < V11.0), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions < V11.0), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions < V11.0), SIPROTEC 5 7SA84 (CP200) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions < V11.0), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions < V11.0), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions < V11.0), SIPROTEC 5 7SD84 (CP200) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions < V11.0), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions < V11.0), SIPROTEC 5 7SJ81 (CP100) (All versions), SIPROTEC 5 7SJ81 (CP150) (All versions < V11.0), SIPROTEC 5 7SJ82 (CP100) (All versions), SIPROTEC 5 7SJ82 (CP150) (All versions < V11.0), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions < V11.0), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions < V11.0), SIPROTEC 5 7SK82 (CP100) (All versions), SIPROTEC 5 7SK82 (CP150) (All versions < V11.0), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions < V11.0), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions < V11.0), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions < V11.0), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions < V11.0), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions < V11.0), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions < V11.0), SIPROTEC 5 7ST86 (CP300) (All versions < V11.0), SIPROTEC 5 7SX82 (CP150) (All versions < V11.0), SIPROTEC 5 7SX85 (CP300) (All versions < V11.0), SIPROTEC 5 7SY82 (CP150) (All versions < V11.0), SIPROTEC 5 7UM85 (CP300) (All versions < V11.0), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions < V11.0), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions < V11.0), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions < V11.0), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions < V11.0), SIPROTEC 5 7VE85 (CP300) (All versions < V11.0), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions < V11.0), SIPROTEC 5 7VU85 (CP300) (All versions < V11.0), SIPROTEC 5 Compact 7SX800 (CP050) (All versions < V11.0). The affected devices include session identifiers in URL requests for certain functionalities. This could allow an attacker to retrieve sensitive session data from browser history, logs, or other storage mechanisms, potentially leading to unauthorized access.

Faiblesses (CWE)

  • CWE-598 — Use of HTTP Request With Sensitive Query String

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:Nsiemens
CVSS 4.0MEDIUM 6.0CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:Nsiemens
CVSS 4.0MEDIUM 6.0CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · productcert@siemens.com (Secondary)
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NNVD · productcert@siemens.com (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Siemens · SIPROTEC 5 6MD84 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 6MD85 (CP200)unaffected 0 < *
Siemens · SIPROTEC 5 6MD85 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 6MD86 (CP200)unaffected 0 < *
Siemens · SIPROTEC 5 6MD86 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 6MD89 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 6MD89 (CP300) V9.6xaffected 0 < V11.0
Siemens · SIPROTEC 5 6MU85 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 7KE85 (CP200)unaffected 0 < *
Siemens · SIPROTEC 5 7KE85 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 7SA82 (CP100)affected 0 < *
Siemens · SIPROTEC 5 7SA82 (CP150)affected 0 < V11.0
Siemens · SIPROTEC 5 7SA84 (CP200)unaffected 0 < *
Siemens · SIPROTEC 5 7SA86 (CP200)unaffected 0 < *
Siemens · SIPROTEC 5 7SA86 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 7SA87 (CP200)unaffected 0 < *
Siemens · SIPROTEC 5 7SA87 (CP300)affected 0 < V11.0
Siemens · SIPROTEC 5 7SD82 (CP100)affected 0 < *
Siemens · SIPROTEC 5 7SD82 (CP150)affected 0 < V11.0
Siemens · SIPROTEC 5 7SD84 (CP200)unaffected 0 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD