CVE-2025-40746 Overview
CVE-2025-40746 is a command injection vulnerability in Siemens SIMATIC RTLS Locating Manager affecting all versions prior to V3.2. The flaw stems from improper input validation in a backup script. An authenticated remote attacker holding high privileges in the application can execute arbitrary code with NT Authority/SYSTEM privileges on the underlying host. The vulnerability is tracked under CWE-20: Improper Input Validation and impacts real-time locating system deployments used across industrial and healthcare environments.
Critical Impact
Successful exploitation yields SYSTEM-level code execution on the SIMATIC RTLS Locating Manager host, exposing tracked asset data, locating infrastructure, and adjacent OT network segments to full compromise.
Affected Products
- Siemens SIMATIC RTLS Locating Manager — all versions prior to V3.2
- Deployments using the affected backup script functionality
- Industrial and enterprise real-time locating system installations running on Windows hosts
Discovery Timeline
- 2025-08-12 - CVE-2025-40746 published to NVD
- 2025-08-12 - Siemens publishes Security Advisory SSA-493787
- 2025-08-20 - Last updated in NVD database
Technical Details for CVE-2025-40746
Vulnerability Analysis
The SIMATIC RTLS Locating Manager exposes a backup script that fails to validate user-supplied input before passing it to the operating system. An authenticated user with high application privileges can inject operating system commands through the backup workflow. The service hosting this functionality runs under the NT Authority/SYSTEM account on Windows, so injected commands inherit the highest local privilege level.
This class of weakness is classified under CWE-20. Because the application processes attacker-controlled data within a privileged execution context, the boundary between application-tier privileges and host-tier privileges collapses. The attacker pivots from an administrative role inside the RTLS application to full control over the Windows server and any data, credentials, or network paths reachable from it.
The attack is reachable over the network, requires no user interaction, and impacts confidentiality, integrity, and availability of both the vulnerable component and downstream subsequent systems. The EPSS probability is approximately 0.68%, reflecting moderate exploitation likelihood relative to other published CVEs.
Root Cause
The backup script accepts input without sanitizing shell metacharacters or constraining values to an expected schema. Any string containing command separators, pipes, or backticks can break out of the intended argument context and execute additional commands within the same privileged process.
Attack Vector
An attacker first authenticates to the SIMATIC RTLS Locating Manager web or management interface with an account that holds high application privileges. The attacker then submits a crafted backup configuration value that carries an OS command payload. When the backup routine executes, the payload runs as NT Authority/SYSTEM. See the Siemens Security Advisory SSA-493787 for vendor-confirmed technical details.
No verified proof-of-concept code is publicly available for CVE-2025-40746.
Refer to the Siemens ProductCERT advisory for vendor-provided guidance.
Detection Methods for CVE-2025-40746
Indicators of Compromise
- Unexpected child processes spawned by the SIMATIC RTLS Locating Manager service, particularly cmd.exe, powershell.exe, or wscript.exe running as NT AUTHORITY\SYSTEM.
- New scheduled tasks, services, or local accounts created on the RTLS host outside of routine maintenance windows.
- Outbound network connections from the RTLS server to unfamiliar external IP addresses immediately after backup operations.
- Anomalous modifications to backup configuration parameters containing shell metacharacters such as &, |, ;, or backticks.
Detection Strategies
- Monitor process-creation telemetry for the RTLS service tree and alert on any non-baseline child process executing under SYSTEM context.
- Inspect application audit logs for backup configuration changes performed by privileged accounts, correlating with host-level command execution events.
- Apply behavioral analytics that flag command interpreters launched by industrial control applications, which is rarely legitimate.
Monitoring Recommendations
- Forward Windows Security, Sysmon, and SIMATIC RTLS application logs to a centralized SIEM or data lake for cross-source correlation.
- Baseline the normal process tree of the SIMATIC RTLS service and alert on deviations.
- Review privileged account activity within the RTLS application on a recurring cadence and revoke unused high-privilege roles.
How to Mitigate CVE-2025-40746
Immediate Actions Required
- Upgrade SIMATIC RTLS Locating Manager to V3.2 or later as instructed in Siemens advisory SSA-493787.
- Restrict network access to the RTLS management interface to trusted operator workstations and jump hosts only.
- Audit and reduce the number of accounts holding high application privileges within the Locating Manager.
- Rotate credentials for any account with administrative access to the RTLS application after patching.
Patch Information
Siemens has released SIMATIC RTLS Locating Manager V3.2, which addresses the input validation flaw in the backup script. Customers should obtain the fixed version through standard Siemens support channels. Refer to Siemens ProductCERT advisory SSA-493787 for download instructions and verification hashes.
Workarounds
- Place the RTLS server inside a segmented OT network zone with strict firewall policies that block direct access from enterprise IT and remote networks, per IEC 62443 guidance.
- Enforce multi-factor authentication and the principle of least privilege for all accounts that can invoke backup operations.
- Disable or tightly control the backup workflow until the upgrade to V3.2 is completed.
- Increase logging verbosity on the RTLS host and forward telemetry to centralized monitoring to shorten detection windows.
# Example firewall rule restricting RTLS management access to a single admin subnet
# Replace 10.10.20.0/24 with your trusted administrative subnet
New-NetFirewallRule -DisplayName "SIMATIC RTLS Mgmt Allow Admin Subnet" `
-Direction Inbound -Protocol TCP -LocalPort 443 `
-RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "SIMATIC RTLS Mgmt Block Others" `
-Direction Inbound -Protocol TCP -LocalPort 443 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
