Back to overview

CVE-2025-40585

CRITICAL
9.9
CVSS 3.1
Description
A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.

Metadata

CVE ID
CVE-2025-40585
State
PUBLISHED
Assigner
siemens
Reserved
2025-04-16 08:20 UTC
Published
2025-06-10 15:17 UTC
Last updated
2025-06-10 17:10 UTC
Primary CWE
CWE-276
CWE-276: Incorrect Default Permissions
Vendor / Product
Siemens / Energy Services
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Siemens Energy Services — 0 < *
Weakness (CWE)
CWESourceDescription
CWE-276 cna CWE-276: Incorrect Default Permissions
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
9.5 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L
References (1)
Back to overview