CVE-2025-40556: BACnet ATEC 550 Series DOS Vulnerability

CVE-2025-40556 Overview

CVE-2025-40556 is a denial of service vulnerability affecting Siemens BACnet Advanced Terminal Equipment Controllers (ATEC). Affected devices improperly handle specific incoming BACnet Master-Slave/Token-Passing (MSTP) messages. An attacker with access to the same BACnet network can send a specially crafted MSTP message that triggers a denial of service condition on the targeted device. Recovery requires a physical power cycle, meaning the device will remain offline until an operator intervenes locally. The flaw is tracked under CWE-20: Improper Input Validation.

Critical Impact
A single crafted MSTP frame can take a building automation controller offline until a manual power cycle is performed, disrupting HVAC and terminal equipment operations.

Affected Products

Siemens BACnet ATEC 550-440 (All versions)
Siemens BACnet ATEC 550-441 (All versions)
Siemens BACnet ATEC 550-445 (All versions)
Siemens BACnet ATEC 550-446 (All versions)

Discovery Timeline

2025-05-13 - CVE-2025-40556 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40556

Vulnerability Analysis

The vulnerability resides in the BACnet MSTP protocol handler on the affected ATEC controllers. BACnet MSTP is a data link layer protocol used across RS-485 serial buses in building automation networks. The affected firmware fails to validate the contents of specific MSTP frames before processing them. When a malformed frame reaches the controller, the parser enters an unrecoverable state that halts device operation.

ATEC controllers regulate terminal equipment such as variable air volume boxes, fan coil units, and unit ventilators. Loss of a controller interrupts room-level environmental control until an operator visits the physical device. Because recovery requires a power cycle, the outage cannot be resolved remotely through the network management interface.

Root Cause

The root cause is improper input validation of incoming BACnet MSTP messages [CWE-20]. The firmware does not enforce length, structure, or state checks that would reject the malformed frame before it reaches downstream processing logic. Once the frame is consumed, the device stops responding to further BACnet traffic.

Attack Vector

Exploitation requires adjacent network access. The attacker must be connected to the same BACnet MSTP segment as the target device, either through direct physical access to the RS-485 bus or through a compromised BACnet router or gateway. No authentication or user interaction is required because BACnet MSTP does not natively provide message authentication. The attack does not compromise confidentiality or integrity; the impact is limited to availability.

Technical details are available in the Siemens Security Advisory SSA-828116.

Detection Methods for CVE-2025-40556

Indicators of Compromise

Affected ATEC controllers becoming unresponsive on the BACnet MSTP bus with no prior configuration change or scheduled maintenance.
Repeated need for manual power cycles to restore a controller to operation.
BACnet traffic captures showing unusual or malformed MSTP frames preceding the loss of communication.

Detection Strategies

Deploy a BACnet-aware operational technology monitoring sensor on the MSTP segment to inspect frame structure and flag protocol anomalies.
Correlate loss-of-communication alarms from the building management system with network traffic captures to identify suspicious frames.
Baseline normal MSTP traffic patterns per segment and alert on deviations in frame types, source addresses, or frame frequency.

Monitoring Recommendations

Log all device availability transitions from the building management system and forward them to a centralized SIEM for correlation.
Monitor physical access to control panels containing ATEC controllers and RS-485 wiring to detect unauthorized bus taps.
Track BACnet router and gateway logs for unexpected devices joining or transmitting on MSTP segments.

How to Mitigate CVE-2025-40556

Immediate Actions Required

Review the Siemens Security Advisory SSA-828116 for the latest vendor guidance and available fixes.
Restrict physical and logical access to BACnet MSTP segments hosting affected ATEC controllers.
Ensure operators are prepared to perform manual power cycles and document affected devices for rapid on-site recovery.

Patch Information

Siemens has not published a firmware fix for the affected ATEC 550-440, 550-441, 550-445, and 550-446 controllers at the time of this writing. Operators should monitor the Siemens Security Advisory SSA-828116 for updates and apply any released firmware as soon as it becomes available through Siemens Industry Online Support.

Workarounds

Segment BACnet MSTP networks from corporate IT networks and any untrusted systems using firewalls or BACnet routers with access control.
Limit BACnet/IP to MSTP routing so that only authenticated, trusted hosts can inject traffic onto the MSTP bus.
Enforce defense-in-depth per the Siemens Operational Guidelines for Industrial Security, including secure remote access and physical protection of controller cabinets.
Maintain an inventory of ATEC controllers with their physical locations so field technicians can quickly locate and power cycle affected devices.