CVE-2025-40772 Overview
CVE-2025-40772 is a stored Cross-Site Scripting (XSS) vulnerability affecting Siemens SiPass integrated access control server applications in all versions prior to V3.0. An attacker with low privileges on an adjacent network can inject malicious script content that is persisted by the server and later executed in the browser context of other users who visit the affected page.
Successful exploitation allows an attacker to impersonate authenticated users, steal session data, and gain unauthorized access to accounts. Chained with account privileges, the flaw can enable privilege escalation within the SiPass integrated management interface. The weakness is tracked under [CWE-79]: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Stored XSS in a physical access control platform can allow session theft and privilege escalation, undermining the integrity of building security workflows.
Affected Products
- Siemens SiPass integrated — all versions prior to V3.0
- Server-side web components rendering attacker-controlled data
- Deployments reachable over adjacent networks by authenticated operators
Discovery Timeline
- 2025-10-14 - CVE-2025-40772 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-40772
Vulnerability Analysis
SiPass integrated is Siemens' access control platform used to manage doors, cardholders, and physical security workflows. The affected server applications fail to properly neutralize user-supplied input before storing it and later rendering it in HTML responses.
An authenticated attacker submits a payload containing HTML or JavaScript through an input field that is persisted server-side. When another operator loads the page that reflects this stored data, the browser executes the attacker's script under the origin of the SiPass web interface. This yields access to session cookies, authentication tokens, and any actions the victim's account is authorized to perform.
Because the payload is stored, exploitation does not require phishing or social engineering beyond convincing a valid user to visit an in-application page they already work with. Exploitation requires adjacent network access and low privileges on the application.
Root Cause
The root cause is missing or insufficient output encoding when rendering user-controlled fields back to the browser. Input accepted by the SiPass server is written to persistent storage and later inserted into HTML without contextual escaping, satisfying the conditions for stored XSS classified under [CWE-79].
Attack Vector
The attack vector is adjacent network with low privileges required and user interaction from a second operator. An attacker with a valid low-privilege account submits crafted content into a stored field. When an administrator or higher-privileged user views the affected page, the injected script executes in their session context, enabling session theft or actions on their behalf.
No public proof-of-concept exploit code is available. Refer to the Siemens Security Advisory SSA-599451 for vendor-provided technical details.
Detection Methods for CVE-2025-40772
Indicators of Compromise
- Stored records within SiPass integrated containing HTML tags such as <script>, <img onerror=>, or javascript: URIs in fields that should contain plain text.
- Unexpected outbound HTTP requests from operator workstations to attacker-controlled hosts shortly after loading SiPass management pages.
- Session cookies or authentication tokens for the SiPass interface being used from unexpected client addresses on the adjacent network.
Detection Strategies
- Inspect the SiPass application database for stored fields containing script tags, event handlers, or encoded payloads that decode to executable content.
- Enable and review web server access logs on the SiPass server for POST requests carrying suspicious payloads and subsequent GET requests loading the affected pages.
- Deploy browser-side Content Security Policy (CSP) reporting where supported to surface inline script execution attempts on the SiPass interface.
Monitoring Recommendations
- Monitor administrator and operator sessions for anomalous activity such as new cardholder creation, permission changes, or configuration edits performed outside normal working hours.
- Alert on repeated authentication or privilege changes originating from a single operator account within short time windows.
- Track network traffic between SiPass operator workstations and the server for unusual patterns indicating token exfiltration.
How to Mitigate CVE-2025-40772
Immediate Actions Required
- Upgrade Siemens SiPass integrated to V3.0 or later per the vendor advisory.
- Restrict network access to the SiPass server so that only authorized operator workstations on trusted management segments can reach the web interface.
- Audit existing operator accounts and remove or reduce privileges for accounts that do not require administrative access.
- Review stored data in SiPass fields and remove entries containing HTML or script content injected by untrusted users.
Patch Information
Siemens has released a fixed version. Apply SiPass integrated V3.0 or later as documented in Siemens Security Advisory SSA-599451. Follow Siemens' upgrade guidance to preserve configuration and cardholder data during migration.
Workarounds
- Isolate the SiPass integrated server on a dedicated management VLAN and enforce firewall rules restricting access to known operator endpoints.
- Enforce least privilege for all SiPass operator roles to reduce the impact of a compromised session.
- Train operators to report unexpected browser behavior, such as unsolicited dialogs or redirects, when using the SiPass management interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
