CVE-2025-27393: Siemens Scalance LPE9403 RCE Vulnerability

CVE-2025-27393 Overview

CVE-2025-27393 is a command injection vulnerability [CWE-78] affecting Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) devices running firmware versions prior to V4.0. The flaw stems from improper sanitization of user input during new user creation. An authenticated attacker with high privileges can supply crafted input that the device passes to an underlying operating system command interpreter. Successful exploitation results in arbitrary code execution on the affected device with the privileges of the underlying service.

The SCALANCE LPE9403 is a Local Processing Engine used in industrial environments to host edge computing workloads adjacent to operational technology (OT) networks. Compromise of these devices can provide a pivot point into industrial control system (ICS) networks.

Critical Impact
Authenticated remote attackers can execute arbitrary OS commands on SCALANCE LPE9403 edge devices, potentially compromising ICS environments and adjacent OT networks.

Affected Products

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) — all firmware versions prior to V4.0
Siemens SCALANCE LPE9403 firmware (scalance_lpe9403_firmware)
Siemens SCALANCE LPE9403 hardware platform (scalance_lpe9403)

Discovery Timeline

2025-03-11 - CVE-2025-27393 published to the National Vulnerability Database (NVD)
2025-03-11 - Siemens publishes Security Advisory SSA-075201
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27393

Vulnerability Analysis

The vulnerability is classified under [CWE-78] Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). When an administrator creates a new user on the SCALANCE LPE9403 device, the firmware accepts user-controlled input fields and incorporates them into a command executed by the underlying operating system without adequate sanitization or argument separation.

An attacker authenticated to the device's management interface with administrative privileges can inject shell metacharacters such as ;, &&, |, or backticks into the input fields used during account creation. The device's command handler concatenates these inputs into a shell invocation, causing the injected payload to execute alongside the intended command.

Because the SCALANCE LPE9403 functions as a Linux-based edge computing platform within OT environments, successful exploitation typically yields execution context with significant access to device configuration, network interfaces, and any hosted workloads.

Root Cause

The firmware's user-management subsystem fails to neutralize shell metacharacters when constructing OS command strings from input collected during account creation. Direct interpolation of untrusted input into a command interpreter (rather than using parameterized APIs or strict allowlists) is the root cause of the injection condition.

Attack Vector

The attack vector is network-based and requires authentication with high privileges (PR:H). An attacker who has obtained administrator credentials—through credential theft, default credential reuse, or insider access—can reach the management interface and trigger the vulnerable code path by submitting a malicious user-creation request. No user interaction is required beyond the attacker's own actions.

Refer to the Siemens Security Advisory SSA-075201 for technical details on the affected endpoint and payload structure.

Detection Methods for CVE-2025-27393

Indicators of Compromise

Unexpected user accounts created on SCALANCE LPE9403 devices, particularly with names containing shell metacharacters such as ;, |, &, or backticks.
New or unexplained outbound network connections originating from the LPE9403 management plane to external hosts.
Modified system binaries, cron entries, or persistence artifacts on the device filesystem following administrative sessions.

Detection Strategies

Audit device configuration backups for user accounts whose names or attributes contain non-alphanumeric special characters.
Correlate management interface authentication logs with user-creation events to identify suspicious administrative activity.
Monitor north-south traffic between OT segments and corporate networks for anomalous flows sourced from SCALANCE LPE9403 IP addresses.

Monitoring Recommendations

Forward SCALANCE LPE9403 syslog and audit events to a centralized SIEM for retention and correlation with broader ICS telemetry.
Establish a baseline of legitimate administrator activity windows and alert on deviations, especially user creation outside change-control windows.
Track firmware versions across the SCALANCE fleet and alert on any device still running a release earlier than V4.0.

How to Mitigate CVE-2025-27393

Immediate Actions Required

Update affected SCALANCE LPE9403 devices to firmware version V4.0 or later as published by Siemens.
Restrict access to the SCALANCE LPE9403 management interface to a dedicated administration VLAN or jump host.
Rotate all administrative credentials on SCALANCE LPE9403 devices and review the account list for unauthorized entries.
Review device audit logs for evidence of prior exploitation, focusing on user-creation events.

Patch Information

Siemens has released firmware version V4.0 for the SCALANCE LPE9403 (6GK5998-3GS00-2AC2) that remediates this vulnerability. Customers should obtain the update through Siemens Industry Online Support and apply it following the vendor's documented upgrade procedure. Full remediation guidance is published in the Siemens Security Advisory SSA-075201.

Workarounds

Limit network access to the device's management ports to trusted engineering workstations only, in line with Siemens Operational Guidelines for Industrial Security.
Enforce defense-in-depth network segmentation between IT and OT zones using firewalls or unidirectional gateways.
Apply the principle of least privilege by minimizing the number of accounts with administrative rights on SCALANCE devices.
Disable or restrict use of the user-creation functionality until the firmware update is applied where operationally feasible.

bash

# Configuration example: restrict management access at the upstream firewall
# Allow only the engineering workstation subnet to reach the LPE9403 management interface
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.0.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.0.10 -p tcp --dport 443 -j DROP