Introduction
Remote attackers can retrieve or modify configuration data on critical industrial communication processors without authenticating. The flaw affects Siemens SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, and SIPLUS ET 200SP variants, which are widely deployed in manufacturing and critical infrastructure for industrial automation and process control.
About the products: Siemens is a global leader in industrial automation. Its SIMATIC and SIPLUS product families run control and communication in factories, utilities, and infrastructure worldwide, and thousands of industrial sites depend on them. A security issue in their communication processors therefore has a large impact.
Technical information
CVE-2025-40771 is caused by missing authentication for configuration connections in the following Siemens communication processors:
- SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0)
- SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0)
- SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0)
- SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0)
- SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0)
- SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0)
All firmware versions prior to V2.4.24 are affected.
The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The affected devices do not require any authentication when a remote user opens a configuration session, so any unauthenticated user with network access to the device's configuration interface can access or modify configuration data. The flaw is limited to the configuration interface and does not affect operational communication channels.
No public code snippets are available for this vulnerability. The root cause is that the affected firmware versions have no authentication logic in the code path that handles configuration connections.
Affected systems and versions
The following Siemens products and versions are vulnerable:
- SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0): all versions prior to V2.4.24
- SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0): all versions prior to V2.4.24
- SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0): all versions prior to V2.4.24
- SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0): all versions prior to V2.4.24
- SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0): all versions prior to V2.4.24
- SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0): all versions prior to V2.4.24
Any deployment of these processors with firmware below V2.4.24 is vulnerable.
Vendor security history
Siemens has fixed authentication and access-control issues in its SIMATIC and SIPLUS product lines before. Past advisories (see references) document similar flaws, including missing or weak authentication for critical functions. Siemens typically ships timely patches for supported products and maintains a dedicated ProductCERT team for vulnerability management. The repeated authentication issues show that secure-by-design implementation is still an ongoing challenge for industrial communication devices.
