{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)", "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "summary", "text": "SIPROTEC 5 is vulnerable to arbitrary file uploads by authenticated users using the DIGSI 5 protocol.\nThis could allow an attacker to upload malicious configuration files, potentially causing a permanent denial of service condition.\n\nAs a mitigation measure, users of the CP050 and CP150 device models are advised to upgrade to version 9.90 or later. For CP300 device models, devices 7ST85 and 7ST86 are advised to upgrade to version 10.00 or later, while the remaining models should upgrade to version 9.90 or later. These versions introduce an allow-list feature that restricts arbitrary file uploads and reduces the risk associated with this vulnerability.\n\nSiemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.", "title": "Summary" }, { "category": "general", "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "productcert@siemens.com", "name": "Siemens ProductCERT", "namespace": "https://www.siemens.com" }, "references": [ { "category": "self", "summary": "SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGSI5 Protocol - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-139483.html" }, { "category": "self", "summary": "SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGSI5 Protocol - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-139483.json" } ], "title": "SSA-139483: File Upload Vulnerability in SIPROTEC 5 Using DIGSI5 Protocol", "tracking": { "current_release_date": "2026-06-09T00:00:00.000Z", "generator": { "engine": { "name": "Siemens ProductCERT CSAF Generator", "version": "1" } }, "id": "SSA-139483", "initial_release_date": "2026-06-09T00:00:00.000Z", "revision_history": [ { "date": "2026-06-09T00:00:00.000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "interim", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MD84 (CP300)", "product_id": "1" } } ], "category": "product_name", "name": "SIPROTEC 5 6MD84 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MD85 (CP200)", "product_id": "2" } } ], "category": "product_name", "name": "SIPROTEC 5 6MD85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MD85 (CP300)", "product_id": "3" } } ], "category": "product_name", "name": "SIPROTEC 5 6MD85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MD86 (CP200)", "product_id": "4" } } ], "category": "product_name", "name": "SIPROTEC 5 6MD86 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MD86 (CP300)", "product_id": "5" } } ], "category": "product_name", "name": "SIPROTEC 5 6MD86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MD89 (CP300)", "product_id": "6" } } ], "category": "product_name", "name": "SIPROTEC 5 6MD89 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 6MU85 (CP300)", "product_id": "7" } } ], "category": "product_name", "name": "SIPROTEC 5 6MU85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7KE85 (CP200)", "product_id": "8" } } ], "category": "product_name", "name": "SIPROTEC 5 7KE85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7KE85 (CP300)", "product_id": "9" } } ], "category": "product_name", "name": "SIPROTEC 5 7KE85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SA82 (CP100)", "product_id": "10" } } ], "category": "product_name", "name": "SIPROTEC 5 7SA82 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SA82 (CP150)", "product_id": "11" } } ], "category": "product_name", "name": "SIPROTEC 5 7SA82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SA86 (CP200)", "product_id": "12" } } ], "category": "product_name", "name": "SIPROTEC 5 7SA86 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SA86 (CP300)", "product_id": "13" } } ], "category": "product_name", "name": "SIPROTEC 5 7SA86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SA87 (CP200)", "product_id": "14" } } ], "category": "product_name", "name": "SIPROTEC 5 7SA87 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SA87 (CP300)", "product_id": "15" } } ], "category": "product_name", "name": "SIPROTEC 5 7SA87 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SD82 (CP100)", "product_id": "16" } } ], "category": "product_name", "name": "SIPROTEC 5 7SD82 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SD82 (CP150)", "product_id": "17" } } ], "category": "product_name", "name": "SIPROTEC 5 7SD82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SD86 (CP200)", "product_id": "18" } } ], "category": "product_name", "name": "SIPROTEC 5 7SD86 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SD86 (CP300)", "product_id": "19" } } ], "category": "product_name", "name": "SIPROTEC 5 7SD86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SD87 (CP200)", "product_id": "20" } } ], "category": "product_name", "name": "SIPROTEC 5 7SD87 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SD87 (CP300)", "product_id": "21" } } ], "category": "product_name", "name": "SIPROTEC 5 7SD87 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ81 (CP100)", "product_id": "22" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ81 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ81 (CP150)", "product_id": "23" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ81 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ82 (CP100)", "product_id": "24" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ82 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ82 (CP150)", "product_id": "25" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ85 (CP200)", "product_id": "26" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ85 (CP300)", "product_id": "27" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ86 (CP200)", "product_id": "28" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ86 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SJ86 (CP300)", "product_id": "29" } } ], "category": "product_name", "name": "SIPROTEC 5 7SJ86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SK82 (CP100)", "product_id": "30" } } ], "category": "product_name", "name": "SIPROTEC 5 7SK82 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SK82 (CP150)", "product_id": "31" } } ], "category": "product_name", "name": "SIPROTEC 5 7SK82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SK85 (CP200)", "product_id": "32" } } ], "category": "product_name", "name": "SIPROTEC 5 7SK85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SK85 (CP300)", "product_id": "33" } } ], "category": "product_name", "name": "SIPROTEC 5 7SK85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SL82 (CP100)", "product_id": "34" } } ], "category": "product_name", "name": "SIPROTEC 5 7SL82 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SL82 (CP150)", "product_id": "35" } } ], "category": "product_name", "name": "SIPROTEC 5 7SL82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SL86 (CP200)", "product_id": "36" } } ], "category": "product_name", "name": "SIPROTEC 5 7SL86 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SL86 (CP300)", "product_id": "37" } } ], "category": "product_name", "name": "SIPROTEC 5 7SL86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SL87 (CP200)", "product_id": "38" } } ], "category": "product_name", "name": "SIPROTEC 5 7SL87 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SL87 (CP300)", "product_id": "39" } } ], "category": "product_name", "name": "SIPROTEC 5 7SL87 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SS85 (CP200)", "product_id": "40" } } ], "category": "product_name", "name": "SIPROTEC 5 7SS85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SS85 (CP300)", "product_id": "41" } } ], "category": "product_name", "name": "SIPROTEC 5 7SS85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7ST85 (CP200)", "product_id": "42" } } ], "category": "product_name", "name": "SIPROTEC 5 7ST85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7ST85 (CP300)", "product_id": "43" } } ], "category": "product_name", "name": "SIPROTEC 5 7ST85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7ST86 (CP300)", "product_id": "44" } } ], "category": "product_name", "name": "SIPROTEC 5 7ST86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SX82 (CP150)", "product_id": "45" } } ], "category": "product_name", "name": "SIPROTEC 5 7SX82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SX85 (CP300)", "product_id": "46" } } ], "category": "product_name", "name": "SIPROTEC 5 7SX85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7SY82 (CP150)", "product_id": "47" } } ], "category": "product_name", "name": "SIPROTEC 5 7SY82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UM85 (CP300)", "product_id": "48" } } ], "category": "product_name", "name": "SIPROTEC 5 7UM85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT82 (CP100)", "product_id": "49" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT82 (CP100)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT82 (CP150)", "product_id": "50" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT82 (CP150)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT85 (CP200)", "product_id": "51" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT85 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT85 (CP300)", "product_id": "52" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT86 (CP200)", "product_id": "53" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT86 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT86 (CP300)", "product_id": "54" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT86 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT87 (CP200)", "product_id": "55" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT87 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7UT87 (CP300)", "product_id": "56" } } ], "category": "product_name", "name": "SIPROTEC 5 7UT87 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7VE85 (CP300)", "product_id": "57" } } ], "category": "product_name", "name": "SIPROTEC 5 7VE85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7VK87 (CP200)", "product_id": "58" } } ], "category": "product_name", "name": "SIPROTEC 5 7VK87 (CP200)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7VK87 (CP300)", "product_id": "59" } } ], "category": "product_name", "name": "SIPROTEC 5 7VK87 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 7VU85 (CP300)", "product_id": "60" } } ], "category": "product_name", "name": "SIPROTEC 5 7VU85 (CP300)" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIPROTEC 5 Compact 7SX800 (CP050)", "product_id": "61" } } ], "category": "product_name", "name": "SIPROTEC 5 Compact 7SX800 (CP050)" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-40808", "cwe": { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type" }, "notes": [ { "category": "summary", "text": "The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61" ] }, "remediations": [ { "category": "mitigation", "details": "
\nUsers are advised to upgrade to V9.90 or later, which introduces an allow-list feature that restricts arbitrary file uploads", "product_ids": [ "1", "3", "5", "6", "7", "9", "11", "13", "15", "17", "19", "21", "23", "25", "27", "29", "31", "33", "35", "37", "39", "41", "45", "46", "47", "48", "50", "52", "54", "56", "57", "59", "60", "61" ] }, { "category": "mitigation", "details": "Apply password protection to all DIGSI connections to ensure secure communication", "product_ids": [ "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61" ] }, { "category": "mitigation", "details": "For DIGSI access provision your own certificates signed by your customer PKI as described in https://support.industry.siemens.com/cs/document/109768375", "product_ids": [ "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61" ] }, { "category": "mitigation", "details": "For the available devices [CP050, CP100, CP150 and CP300] , activate role based access control (RBAC) in the device (supported in SIPROTEC 5 firmware versions V7.80 and higher)", "product_ids": [ "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61" ] }, { "category": "mitigation", "details": "Users are advised to upgrade to V10.00 or later, which introduces an allow-list feature that restricts arbitrary file uploads", "product_ids": [ "43", "44" ] }, { "category": "no_fix_planned", "details": "Currently no fix is planned", "product_ids": [ "2", "4", "8", "10", "12", "14", "16", "18", "20", "22", "24", "26", "28", "30", "32", "34", "36", "38", "40", "42", "49", "51", "53", "55", "58" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "1", "3", "5", "6", "7", "9", "11", "13", "15", "17", "19", "21", "23", "25", "27", "29", "31", "33", "35", "37", "39", "41", "43", "44", "45", "46", "47", "48", "50", "52", "54", "56", "57", "59", "60", "61" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61" ] } ], "title": "CVE-2025-40808" } ] }