Critical severity · published May 9, 2023
CVE-2023-27407
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1)
9.9
CVSS
1.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Scalance Lpe9403 Firmware · Siemens
before 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27407
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-325383.pdf
More from Scalance Lpe9403 Firmware
7.8
CVE-2022-0847
Linux Kernel Privilege Escalation Vulnerability
7.8
CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
8.8
CVE-2025-27396
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0)
7.8
CVE-2025-40582
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed)
7.8
CVE-2025-40580
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0)