CVE-2025-27394

HighRCE

Published: 11 March 2025

Published

11 March 2025

Modified

22 August 2025

KEV Added

—

Patch

—

CVSS Score v4 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0262 86.0th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27394 is a high-severity OS Command Injection (CWE-78) vulnerability in Siemens Scalance Lpe9403 Firmware. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 14.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability CVE-2025-27394 affects Siemens SCALANCE LPE9403 devices (part number 6GK5998-3GS00-2AC2) running all versions prior to V4.0. It arises from insufficient sanitization of user input when creating new SNMP users and is tracked as CWE-78, enabling OS command injection with a CVSS 4.0 score of 8.6.

An authenticated remote attacker possessing high privileges can exploit the flaw over the network to execute arbitrary code on the device, resulting in full control over its confidentiality, integrity, and availability.

The Siemens security advisory SSA-075201 at https://cert-portal.siemens.com/productcert/html/ssa-075201.html addresses mitigation steps and available updates for affected devices. The associated EPSS score reached a peak of 0.0440 after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7764

Vulnerability details

A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new SNMP users. This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the…

device.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

OS command injection (CWE-78) enables authenticated high-priv remote attacker to achieve arbitrary code execution and full device compromise, directly mapping to exploitation for privilege escalation (T1068) and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0