Medium ICSA-25-162-04 3 CVEs

Siemens SCALANCE and RUGGEDCOM

Published Jun 10, 2025 · Updated Jan 14, 2026 · Revision 3

Vendor: Siemens Product: RUGGEDCOM RST2428P (6GK6242-6PA00) Product: SCALANCE XC316-8 (6GK5324-8TS00-2AC2) Product: SCALANCE XC324-4 (6GK5328-4TS00-2AC2) Product: SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) Product: SCALANCE XC332 (6GK5332-0GA00-2AC2) Product: SCALANCE XC416-8 (6GK5424-8TR00-2AC2) Product: SCALANCE XC424-4 (6GK5428-4TR00-2AC2) Product: SCALANCE XC432 (6GK5432-0GR00-2AC2) Product: SCALANCE XCH328 (6GK5328-4TS01-2EC2) Product: SCALANCE XCM324 (6GK5324-8TS01-2AC2) Product: SCALANCE XCM328 (6GK5328-4TS01-2AC2) Product: SCALANCE XCM332 (6GK5332-0GA01-2AC2) Product: SCALANCE XR302-32 (6GK5334-5TS00-2AR3) Product: SCALANCE XR302-32 (6GK5334-5TS00-3AR3) Product: SCALANCE XR302-32 (6GK5334-5TS00-4AR3) Product: SCALANCE XR322-12 (6GK5334-3TS00-2AR3) Product: SCALANCE XR322-12 (6GK5334-3TS00-3AR3) Product: SCALANCE XR322-12 (6GK5334-3TS00-4AR3) Product: SCALANCE XR326-8 (6GK5334-2TS00-2AR3) Product: SCALANCE XR326-8 (6GK5334-2TS00-3AR3) Product: SCALANCE XR326-8 (6GK5334-2TS00-4AR3) Product: SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) Product: SCALANCE XR502-32 (6GK5534-5TR00-2AR3) Product: SCALANCE XR502-32 (6GK5534-5TR00-3AR3) Product: SCALANCE XR502-32 (6GK5534-5TR00-4AR3) Product: SCALANCE XR522-12 (6GK5534-3TR00-2AR3) Product: SCALANCE XR522-12 (6GK5534-3TR00-3AR3) Product: SCALANCE XR522-12 (6GK5534-3TR00-4AR3) Product: SCALANCE XR526-8 (6GK5534-2TR00-2AR3) +12 more

Summary

Several Industrial Communication Devices based on SINEC OS before V3.2 contain multiple vulnerabilities that could allow an attacker to circumvent authorization checks and perform actions that exceed the permissions of the "guest" role.

Siemens has released new versions for the affected products and recommends to update to the latest versions.

Vulnerabilities 3

Medium 6.5

CVE-2025-40567

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK53…

Siemens RUGGEDCOM RST2428P SCALANCE XRM334 (2x230 V AC, 12xFO) SCALANCE XRH334 (24 V DC, 8xFO, CC) ICS / OT

Jun 10, 2025
Medium 4.8

CVE-2025-40569

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK53…

Siemens RUGGEDCOM RST2428P SCALANCE XRM334 (24 V DC, 8xFO) SCALANCE XCM328 ICS / OT

Jun 10, 2025
Medium 4.3

CVE-2025-40568

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK53…

Siemens RUGGEDCOM RST2428P SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) SCALANCE XCM332 ICS / OT

Jun 10, 2025

Revision history

2026-01-14 #3
Initial Republication of Siemens ProductCERT SSA-693776 advisory
2026-01-13 #2
Corrected SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family to known not affected.
2025-06-10 #1
Publication Date

References

SSA-693776: Multiple Vulnerabilities in Industrial Communication Devices based on SINEC OS before V3.2 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-693776.html
ICS Advisory ICSA-25-162-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-04
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b