Medium severity · published Aug 12, 2025
CVE-2025-40753
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >=…
6.2
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q200 family (All versions >= V2.70 < V2.80). Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
POWER METER SICAM Q100 · Siemens
V2.60 before V2.62; V2.60 before V2.62; V2.60 before V2.62; V2.60 before V2.62 · source: vendor
PM
POWER METER SICAM Q200 family · Siemens
V2.70 before V2.80 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40753
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-529291.html
More from POWER METER SICAM Q100
6.2
CVE-2025-40752
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >=…