High severity · published Aug 12, 2025
CVE-2025-40743
A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All versions < V4.95…
8.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All versions < V4.95 SP5), SINUMERIK MC (All versions < V1.25 SP1), SINUMERIK MC V1.15 (All versions < V1.15 SP5), SINUMERIK ONE (All versions < V6.25 SP1), SINUMERIK ONE V6.15 (All versions < V6.15 SP5). The affected application improperly validates authentication for its VNC access service, allowing access with insufficient password verification.
This could allow an attacker to gain unauthorized remote access and potentially compromise system confidentiality, integrity, or availability.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S8
SINUMERIK 828D PPU.4 · Siemens
before V4.95 SP5 · source: vendor
S8
SINUMERIK 828D PPU.5 · Siemens
before V5.25 SP1 · source: vendor
S8
SINUMERIK 840D sl · Siemens
before V4.95 SP5 · source: vendor
SM
SINUMERIK MC · Siemens
before V1.25 SP1 · source: vendor
SM
SINUMERIK MC V1.15 · Siemens
before V1.15 SP5 · source: vendor
SO
SINUMERIK ONE · Siemens
before V6.25 SP1 · source: vendor
SO
SINUMERIK ONE V6.15 · Siemens
before V6.15 SP5 · source: vendor