by Kastro
Paper/Archive/CVE-2025-40585

CVE-2025-40585

Siemens Energy Services — A vulnerability has been identified in Energy Services (All versions with G5DFR).

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
36
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 33.7.337 × 206.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.

Affected

ProductAffectedFixed inSource
Energy Servicesall versions–CNA

Scores by source

siemens (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
siemens (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcert-portal.siemens.com/productcert/html/ssa-345750.html