CVE-2025-40578: Siemens Scalance LPE9403 DoS Vulnerability

CVE-2025-40578 Overview

CVE-2025-40578 affects the Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) local processing engine across all firmware versions. The device fails to properly handle multiple incoming Profinet packets received in rapid succession. An unauthenticated attacker with adjacent network access can send a burst of Profinet packets to crash the dcpd process. This results in a denial-of-service condition on the affected industrial device. The flaw is tracked under CWE-125 (Out-of-Bounds Read) and documented in Siemens Security Advisory SSA-327438.

Critical Impact
An unauthenticated attacker on an adjacent network can crash the Profinet Discovery and Configuration Protocol daemon (dcpd) on SCALANCE LPE9403 devices, disrupting industrial network operations.

Affected Products

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) — All versions
Siemens SCALANCE LPE9403 firmware — All versions
Deployments using the on-device Profinet DCP daemon (dcpd)

Discovery Timeline

2025-05-13 - CVE-2025-40578 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40578

Vulnerability Analysis

The vulnerability resides in how the SCALANCE LPE9403 processes Profinet frames on the local network segment. Profinet uses the Discovery and Configuration Protocol (DCP) for device discovery and configuration on Layer 2. The dcpd daemon parses these frames as they arrive on the wire.

When multiple DCP packets arrive in a very short time frame, the daemon fails to handle the queued input correctly. The condition maps to [CWE-125] (Out-of-Bounds Read), indicating the parser reads past the intended memory boundary while processing back-to-back frames. The result is a crash of the dcpd process rather than memory disclosure or code execution.

Because the SCALANCE LPE9403 is deployed as an industrial edge computing platform, loss of the Profinet management daemon disrupts device discovery, provisioning, and configuration workflows on the operational technology (OT) segment.

Root Cause

The root cause is improper input handling in the dcpd implementation when processing rapid successive Profinet frames. Insufficient bounds checking during frame parsing produces an out-of-bounds read that terminates the process.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same Layer 2 broadcast domain as the target device. Profinet DCP is a Layer 2 protocol and cannot be routed across IP boundaries. No authentication or user interaction is required.

An attacker sends multiple crafted or repeated Profinet DCP packets in rapid succession to the LPE9403. The dcpd process crashes, denying legitimate Profinet management traffic until the service or device is restarted.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to Siemens Security Advisory SSA-327438 for vendor technical details.

Detection Methods for CVE-2025-40578

Indicators of Compromise

Unexpected termination or restart events for the dcpd process on SCALANCE LPE9403 devices
Bursts of Profinet DCP frames (EtherType 0x8892) from a single MAC address in a short window
Loss of Profinet device discovery and configuration on the affected OT segment
Repeated SNMP or syslog alerts indicating service crashes on the LPE9403

Detection Strategies

Monitor Layer 2 traffic for anomalous rates of Profinet DCP frames destined for SCALANCE LPE9403 MAC addresses
Baseline normal DCP traffic volume and alert on deviations exceeding operational thresholds
Correlate device crash logs with concurrent network packet captures from mirror or SPAN ports
Deploy an industrial intrusion detection sensor with Profinet dissectors to flag malformed or flooded DCP traffic

Monitoring Recommendations

Enable and forward device syslog from SCALANCE LPE9403 to a centralized log platform for dcpd crash correlation
Track MAC-address source diversity on Profinet DCP frames to identify single-source flooding
Instrument OT network taps to record baseline DCP traffic for forensic comparison
Configure alerts on repeated device availability transitions in the network management system

How to Mitigate CVE-2025-40578

Immediate Actions Required

Review Siemens Security Advisory SSA-327438 for the current fix status and recommended firmware version
Restrict Layer 2 access to the SCALANCE LPE9403 to trusted engineering and control network segments only
Segment the Profinet network from corporate IT and any untrusted endpoints using VLANs and managed switches
Apply Siemens operational guidelines for securing industrial devices, including physical access controls

Patch Information

Siemens tracks remediation status in advisory SSA-327438. Operators should consult the advisory for the latest firmware release addressing the dcpd crash and schedule updates through validated OT change-management processes.

Workarounds

Enforce strict network segmentation so only authorized Profinet controllers and engineering stations share the Layer 2 domain with the LPE9403
Enable port security and MAC address filtering on managed switches connected to SCALANCE devices
Deploy rate limiting or storm control on switch ports facing untrusted hosts to constrain DCP flood conditions
Monitor for dcpd restarts and implement automated notification to OT operators for rapid response

bash

# Example: switch port hardening on the Profinet segment
configure terminal
interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 100
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 storm-control broadcast level 1.00
 storm-control multicast level 1.00
 storm-control action shutdown
end