CVE-2025-40742: SIPROTEC 5 Information Disclosure Issue

CVE-2025-40742 Overview

CVE-2025-40742 affects a broad range of Siemens SIPROTEC 5 protection relays used in electrical substations and industrial control environments. The affected devices embed session identifiers directly in URL request parameters for certain web-based functionalities. An attacker who obtains browser history, proxy logs, server access logs, or referrer headers can extract these session tokens. Reused tokens grant unauthorized access to authenticated device functions. The issue is classified as [CWE-598] Use of GET Request Method With Sensitive Query Strings.

Critical Impact
Exposure of session identifiers in URLs enables unauthorized access to industrial protection relays managing substation equipment, with the vulnerability affecting more than 60 SIPROTEC 5 product variants across CP100, CP150, CP200, and CP300 hardware platforms.

Affected Products

SIPROTEC 5 CP300 devices (6MD84, 6MD85, 6MD86, 6MD89, 6MU85, 7KE85, and others) - all versions prior to V11.0
SIPROTEC 5 CP200 devices (6MD85, 6MD86, 7KE85, 7SA84, 7SA86, 7SA87, and others) - all versions affected
SIPROTEC 5 CP100/CP150 devices (7SA82, 7SD82, 7SJ81, 7SJ82, 7SK82, 7SL82, 7UT82) and SIPROTEC 5 Compact 7SX800 (CP050) prior to V11.0

Discovery Timeline

2025-07-08 - CVE-2025-40742 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40742

Vulnerability Analysis

The SIPROTEC 5 web interface passes session identifiers as query string parameters instead of transmitting them exclusively through secure HTTP cookies with appropriate flags. Query string values persist in multiple locations outside the client-server exchange. Browser history retains full URLs. Proxy servers and load balancers log query strings by default. The HTTP Referer header can leak the identifier to any external resource loaded by the page.

An attacker with access to any of these secondary storage locations can replay the captured session identifier against the device. This provides authenticated access without knowledge of user credentials. Because SIPROTEC 5 devices operate as protection relays in electrical substations, unauthorized session reuse can expose configuration data, diagnostic information, and operational status of critical grid infrastructure.

Root Cause

The root cause is insecure session identifier transport. The web application appends session tokens to URLs rather than binding them exclusively to HttpOnly and Secure cookies. This design decision violates the principle that sensitive credentials must never appear in loggable or cacheable locations. The weakness maps to [CWE-598], which specifically addresses sensitive information exposure through GET request query strings.

Attack Vector

Exploitation requires user interaction, as reflected in the CVSS 4.0 vector UI:P. A typical scenario involves an attacker gaining access to a workstation used by a substation engineer. Browser history, cached URLs, or exported HAR files can then reveal valid session tokens. Alternatively, an attacker positioned to read proxy or gateway logs can harvest identifiers passively. Once a token is captured, replay is straightforward using any HTTP client. The attack does not require code execution on the target device and leaves minimal forensic traces on the SIPROTEC 5 unit itself.

The vulnerability manifests in URL-based session handling within the device web interface. See the Siemens Security Advisory SSA-904646 for authoritative technical details.

Detection Methods for CVE-2025-40742

Indicators of Compromise

HTTP requests to SIPROTEC 5 management interfaces containing session identifiers as URL query parameters, particularly repeated requests reusing the same token from different source addresses
Unexpected access to SIPROTEC 5 web interfaces from workstations that have not previously interacted with the device
Proxy or firewall logs showing SIPROTEC 5 URLs with embedded session tokens forwarded to unexpected destinations via Referer headers

Detection Strategies

Inspect network traffic to and from SIPROTEC 5 devices for query strings containing session identifier patterns such as sessionid=, sid=, or token=
Correlate SIPROTEC 5 access events with authenticated user sessions to identify token reuse across disparate source IP addresses
Review browser cache, history, and exported artifacts on operator workstations for stored URLs referencing SIPROTEC 5 devices

Monitoring Recommendations

Enable OT network monitoring on the substation LAN segment carrying HTTP or HTTPS traffic to SIPROTEC 5 devices
Forward web server and proxy logs from OT jump hosts to a centralized platform such as Singularity Data Lake for OCSF-normalized retention and query
Alert on any SIPROTEC 5 authentication event originating from an IP address outside the approved engineering workstation range

How to Mitigate CVE-2025-40742

Immediate Actions Required

Upgrade affected CP300 and CP150 devices to firmware V11.0 or later, which addresses the session handling defect
Restrict network access to SIPROTEC 5 management interfaces using firewall rules that permit only approved engineering workstations
Clear browser history, cache, and saved sessions on any workstation that has accessed the affected devices

Patch Information

Siemens has released firmware V11.0 for the affected CP150 and CP300 platforms. CP100 and CP200 hardware platforms have no fix listed in the advisory and require compensating controls. Consult the Siemens Security Advisory SSA-904646 for the current fix status per product variant.

Workarounds

Place SIPROTEC 5 devices behind a dedicated management VPN and prohibit direct browser access from general-purpose workstations
Disable or restrict proxy logging for URLs matching SIPROTEC 5 management endpoints, and remove any archived logs that may contain historical session identifiers
Terminate active sessions and force reauthentication at short intervals to reduce the value of any captured session identifier

bash

# Example firewall rule limiting SIPROTEC 5 web access to a single engineering workstation
iptables -A FORWARD -s 10.20.30.40 -d 10.10.10.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.10.0/24 -p tcp --dport 443 -j DROP