CVE-2025-40820

Published Dec 9, 2025 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Siemens
Siemens sidoor Atd430w
Siemens sidoor Ate530s Coated
Siemens simatic
Siemens simatic Cfc
Siemens simatic Cfu Diq
Siemens simatic Cfu Pa
Siemens simatic Et200al Im 157-1 Pn
Siemens simatic Et200sp Im155-6 Mf Hf
Siemens simatic Et 200mp Im 155-5 Pn Hf
Siemens simatic Et 200s
Siemens simatic Pcs
Siemens simatic Pdm
Siemens simatic S7-1500 Cpu 1510sp-1 Pn
Siemens simatic S7-1500 Cpu 1510sp F-1 Pn
Siemens simatic S7-1500 Cpu 1512sp-1 Pn
Siemens simatic S7-1500 Cpu 1512sp F-1 Pn
Vendors & Products Siemens
Siemens sidoor Atd430w
Siemens sidoor Ate530s Coated
Siemens simatic
Siemens simatic Cfc
Siemens simatic Cfu Diq
Siemens simatic Cfu Pa
Siemens simatic Et200al Im 157-1 Pn
Siemens simatic Et200sp Im155-6 Mf Hf
Siemens simatic Et 200mp Im 155-5 Pn Hf
Siemens simatic Et 200s
Siemens simatic Pcs
Siemens simatic Pdm
Siemens simatic S7-1500 Cpu 1510sp-1 Pn
Siemens simatic S7-1500 Cpu 1510sp F-1 Pn
Siemens simatic S7-1500 Cpu 1512sp-1 Pn
Siemens simatic S7-1500 Cpu 1512sp F-1 Pn
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
Weaknesses CWE-940
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}