Unrestricted file upload in Siemens SIPROTEC 5 6MD84
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions), SIPROTEC 5 6MD89 (CP300) (All versions), SIPROTEC 5 6MU85 (CP300) (All versions), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions), SIPROTEC 5 7SJ81 (CP100) (All versions), SIPROTEC 5 7SJ81 (CP150) (All versions), SIPROTEC 5 7SJ82 (CP100) (All versions), SIPROTEC 5 7SJ82 (CP150) (All versions), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions), SIPROTEC 5 7SK82 (CP100) (All versions), SIPROTEC 5 7SK82 (CP150) (All versions), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions), SIPROTEC 5 7ST86 (CP300) (All versions), SIPROTEC 5 7SX82 (CP150) (All versions), SIPROTEC 5 7SX85 (CP300) (All versions), SIPROTEC 5 7SY82 (CP150) (All versions), SIPROTEC 5 7UM85 (CP300) (All versions), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions), SIPROTEC 5 7VE85 (CP300) (All versions), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions), SIPROTEC 5 7VU85 (CP300) (All versions), SIPROTEC 5 Compact 7SX800 (CP050) (All versions). The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIPROTEC 5 6MD84 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 6MD85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 6MD85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 6MD86 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 6MD86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 6MD89 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 6MU85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7KE85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7KE85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SA82 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SA82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SA86 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SA86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SA87 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SA87 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SD82 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SD82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SD86 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SD86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SD87 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SD87 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ81 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ81 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ82 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ86 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SJ86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SK82 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SK82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SK85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SK85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SL82 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SL82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SL86 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SL86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SL87 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SL87 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SS85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SS85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7ST85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7ST85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7ST86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SX82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SX85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7SY82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UM85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT82 (CP100) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT82 (CP150) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT85 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT86 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT86 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT87 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7UT87 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7VE85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7VK87 (CP200) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7VK87 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 7VU85 (CP300) | all versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 Compact 7SX800 (CP050) | all versions | — | No fix listed | CNA |
- SIPROTEC 5 6MD84 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 6MD85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 6MD85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 6MD86 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 6MD86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 6MD89 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 6MU85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7KE85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7KE85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SA82 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SA82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SA86 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SA86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SA87 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SA87 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SD82 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SD82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SD86 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SD86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SD87 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SD87 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ81 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ81 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ82 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ86 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SJ86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SK82 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SK82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SK85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SK85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SL82 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SL82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SL86 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SL86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SL87 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SL87 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SS85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SS85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7ST85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7ST85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7ST86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SX82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SX85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7SY82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UM85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT82 (CP100) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT82 (CP150) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT85 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT86 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT86 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT87 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7UT87 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7VE85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7VK87 (CP200) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7VK87 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 7VU85 (CP300) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SIPROTEC 5 Compact 7SX800 (CP050) VendorSiemens Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-40808
- 2026-10-03 Alias added: GHSA-37wv-74x7-5f3m
References
More Siemens vulnerabilities
- TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-40808 · CVE Program
- CVE-2025-40808 · NVD
- FIRST EPSS
- GHSA-37wv-74x7-5f3m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences