CVE-2025-27395: Siemens Scalance LPE9403 Privilege Escalation Vulnerability

CVE-2025-27395 Overview

CVE-2025-27395 is a path traversal vulnerability [CWE-22] affecting Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) local processing engine devices running firmware versions prior to V4.0. The device does not properly limit the scope of files accessible through the Secure File Transfer Protocol (SFTP) functionality, nor does it correctly restrict the privileges granted to SFTP sessions. An authenticated attacker with high privileges can leverage this weakness to read and write arbitrary files on the underlying operating system across a network connection. The flaw impacts industrial edge computing deployments where SCALANCE LPE9403 hosts containerized applications for Operational Technology (OT) environments.

Critical Impact
Authenticated remote attackers can read and write arbitrary files on affected SCALANCE LPE9403 devices, enabling tampering with system files, application containers, and industrial edge workloads.

Affected Products

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) — all firmware versions prior to V4.0
Siemens SCALANCE LPE9403 firmware (scalance_lpe9403_firmware)
Siemens SCALANCE LPE9403 hardware appliance (scalance_lpe9403)

Discovery Timeline

2025-03-11 - CVE-2025-27395 published to the National Vulnerability Database (NVD)
2025-03-11 - Siemens ProductCERT publishes advisory SSA-075201
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27395

Vulnerability Analysis

The SCALANCE LPE9403 is a Linux-based local processing engine designed to host user applications at the edge of industrial networks. The device exposes an SFTP service to support file transfer to and from hosted applications. The SFTP implementation fails to enforce a restricted directory scope and does not downgrade session privileges to those of the intended application user.

Because the SFTP session operates with excessive filesystem visibility and elevated permissions, an authenticated user can navigate outside the intended sandbox. This allows reading configuration files, credentials, container images, and other sensitive assets, and overwriting binaries or configuration used by the device firmware.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22], combined with insufficient privilege separation in the SFTP subsystem. Rather than confining sessions to a chrooted directory tied to the authenticated principal, the service resolves paths against the full root filesystem. The SFTP daemon also inherits privileges beyond what the user role should possess for file transfer operations.

Attack Vector

Exploitation requires network access to the SFTP service on the SCALANCE LPE9403 and valid credentials for a high-privilege account. Once authenticated, an attacker issues standard SFTP path operations that reference absolute paths or relative traversal sequences to access files outside the expected transfer directory. Because the vulnerability affects both read and write operations, an attacker can exfiltrate sensitive data and stage persistent tampering by overwriting scripts, systemd units, or container definitions used by the device.

No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Siemens Security Advisory SSA-075201 for vendor-supplied technical details.

Detection Methods for CVE-2025-27395

Indicators of Compromise

SFTP session logs on SCALANCE LPE9403 devices showing access to absolute paths outside the expected application transfer directory (for example, /etc/, /root/, /var/lib/).
Unexpected modifications to firmware configuration files, container images, or startup scripts on the device.
SFTP authentication events for privileged accounts originating from operator workstations or IP ranges that do not normally administer edge devices.

Detection Strategies

Monitor authentication logs from SCALANCE LPE9403 devices for SFTP sessions established by high-privilege accounts and correlate with the file paths accessed during each session.
Baseline the set of files normally read and written by legitimate application deployments, and alert on deviations such as access to system directories.
Perform firmware version inventory across all deployed SCALANCE LPE9403 units and flag any device below V4.0 as vulnerable.

Monitoring Recommendations

Forward SCALANCE LPE9403 syslog output to a centralized SIEM or data lake for retention and correlation with network flow data.
Capture NetFlow or packet metadata for TCP port 22 traffic to and from LPE9403 devices, and alert on connections from sources outside the defined engineering management zone.
Track file integrity of critical device configuration and container manifests where the platform permits.

How to Mitigate CVE-2025-27395

Immediate Actions Required

Update SCALANCE LPE9403 (6GK5998-3GS00-2AC2) firmware to V4.0 or later per Siemens advisory SSA-075201.
Restrict network access to the SFTP service on port 22 to trusted engineering workstations using firewall rules or network segmentation.
Rotate credentials for all high-privilege accounts on affected devices, particularly if the device has been reachable from broader operations networks.
Audit SFTP session history for evidence of access to paths outside the intended application directory.

Patch Information

Siemens has released firmware version V4.0 for the SCALANCE LPE9403 (6GK5998-3GS00-2AC2) that remediates CVE-2025-27395. Refer to Siemens Security Advisory SSA-075201 for download instructions and update procedures. Follow the vendor's operational guidance to validate application container compatibility before deploying the update to production sites.

Workarounds

Apply Siemens' defense-in-depth recommendations for industrial control system security, including placing devices behind an ICS-aware firewall and using a dedicated management VLAN.
Limit account provisioning on affected devices so that only a minimum number of highly-privileged users possess SFTP access.
Disable or block the SFTP service at the network layer when active file transfer is not required for application lifecycle operations.

bash

# Example ACL restricting SFTP (TCP/22) to a management subnet
# Replace 10.10.20.0/24 with the authorized engineering workstation range
# and 10.20.30.10 with the SCALANCE LPE9403 management IP
iptables -A FORWARD -p tcp -s 10.10.20.0/24 -d 10.20.30.10 --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.20.30.10 --dport 22 -j DROP