CVE-2025-40808: Siemens SIPROTEC 5 DoS Vulnerability

CVE-2025-40808 Overview

CVE-2025-40808 is an arbitrary file upload vulnerability affecting a wide range of Siemens SIPROTEC 5 protection relay devices. The flaw resides in the DIGSI 5 protocol handler, which permits authenticated users to upload arbitrary files to the device. An attacker with valid credentials on an adjacent network can upload malicious configuration files, causing a denial of service condition and potentially leading to code execution on the affected device. The issue is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type) and is documented in Siemens Security Advisory SSA-139483.

Critical Impact
Authenticated attackers on an adjacent network can upload malicious configuration files to SIPROTEC 5 protection relays, causing denial of service and potential code execution on critical power-grid devices.

Affected Products

Siemens SIPROTEC 5 devices on CP100, CP150, CP200, and CP300 communication processors (all versions), including models 6MD84, 6MD85, 6MD86, 6MD89, 6MU85, 7KE85, 7SA82/86/87, 7SD82/86/87, 7SJ81/82/85/86, 7SK82/85, 7SL82/86/87, 7SS85, 7ST85/86, 7SX82/85, 7SY82, 7UM85, 7UT82/85/86/87, 7VE85, 7VK87, and 7VU85
Siemens SIPROTEC 5 Compact 7SX800 (CP050) (all versions)
All firmware versions of the listed devices that expose the DIGSI 5 protocol interface

Discovery Timeline

2026-06-09 - CVE-2025-40808 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2025-40808

Vulnerability Analysis

The vulnerability stems from insufficient validation of file uploads handled by the DIGSI 5 engineering protocol on SIPROTEC 5 devices. DIGSI 5 is the configuration and engineering protocol used to provision protection settings, firmware components, and runtime configuration on these intelligent electronic devices (IEDs). The protocol accepts file uploads from authenticated users but does not adequately restrict file types, locations, or contents.

An attacker who obtains valid high-privilege credentials and network reachability to the device can upload arbitrary files. Crafted configuration files may disrupt the protection relay's operation, knocking the device offline and producing a denial of service. Because configuration files influence executable logic on the relay, the vendor states the condition could potentially lead to code execution.

In an operational technology context, denial of service against a SIPROTEC 5 relay can prevent fault isolation in substations, delaying protective tripping or disabling teleprotection schemes.

Root Cause

The root cause is unrestricted file upload [CWE-434] in the DIGSI 5 protocol handler. The device trusts authenticated users to provide well-formed, safe configuration artifacts and does not enforce strict allowlists on file type, signature, or destination path before persisting uploaded content.

Attack Vector

Exploitation requires adjacent network access to the device's DIGSI 5 service and valid high-privilege authentication. The attacker initiates a normal DIGSI 5 session, then transmits a malicious file payload disguised as or embedded within a configuration upload. No user interaction is required at the target. Refer to Siemens Security Advisory SSA-139483 for protocol-level technical details.

Detection Methods for CVE-2025-40808

Indicators of Compromise

Unexpected DIGSI 5 sessions originating from hosts that are not authorized engineering workstations
SIPROTEC 5 devices entering unexpected restart cycles or protection function unavailability following a configuration upload
Configuration version or checksum changes on relays without a corresponding change-management record
Outbound connections from engineering workstations to unfamiliar internal hosts preceding device configuration changes

Detection Strategies

Capture and inspect DIGSI 5 protocol traffic at substation network boundaries to identify file upload operations and correlate them with approved change windows
Baseline normal engineering activity per device and alert on file uploads outside maintenance windows or from unauthorized source addresses
Compare device configuration hashes against a known-good repository on a recurring basis to detect unauthorized modifications

Monitoring Recommendations

Forward syslog and audit events from SIPROTEC 5 devices and engineering workstations to a central SIEM for correlation
Monitor authentication events on DIGSI 5 services for failed logins, off-hours sessions, and use of shared or stale accounts
Alert on relay self-diagnostic faults, protection function blocking, or device reboots that coincide with management plane activity

How to Mitigate CVE-2025-40808

Immediate Actions Required

Review Siemens Security Advisory SSA-139483 and apply vendor-provided fixes or mitigations as they become available
Restrict network access to the DIGSI 5 protocol so that only designated engineering workstations within a trusted security zone can reach SIPROTEC 5 devices
Rotate credentials used for DIGSI 5 authentication and enforce role separation so that file upload privileges are limited to a minimal set of accounts
Inventory all SIPROTEC 5 assets across substations to confirm exposure scope before initiating remediation

Patch Information

At the time of publication, the Siemens advisory lists all firmware versions of the affected SIPROTEC 5 models as vulnerable. Operators should monitor Siemens Security Advisory SSA-139483 for updated firmware releases and follow the recommended upgrade procedure for each device family and communication processor (CP050, CP100, CP150, CP200, CP300).

Workarounds

Segment the substation automation network and place SIPROTEC 5 devices behind firewalls that only allow DIGSI 5 traffic from authorized engineering hosts
Disable or block the DIGSI 5 service on devices that do not require remote engineering access, following Siemens operational guidance
Apply Siemens' general Operational Guidelines for Industrial Security to harden the substation environment
Require jump-host access with multi-factor authentication for all engineering sessions targeting SIPROTEC 5 devices

bash

# Example firewall rule restricting DIGSI 5 access to authorized engineering host
# Replace <ENG_WS_IP> with the engineering workstation address and <RELAY_IP> with the SIPROTEC 5 device address
iptables -A FORWARD -s <ENG_WS_IP> -d <RELAY_IP> -p tcp --dport 4443 -j ACCEPT
iptables -A FORWARD -d <RELAY_IP> -p tcp --dport 4443 -j DROP