CVE-2025-27396
Published: 11 March 2025
Summary
CVE-2025-27396 is a high-severity Improper Check for Dropped Privileges (CWE-273) vulnerability in Siemens Scalance Lpe9403 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 22.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces the principle of least privilege to ensure users and processes operate with minimal privileges necessary, directly mitigating the CVE's failure to properly limit privilege elevation for valid functionality.
Requires mechanisms to enforce approved authorizations for logical access and privilege elevation, addressing the improper limitation that allows low-privileged attackers to escalate privileges.
Mandates timely flaw remediation including firmware updates to V4.0 or later, directly patching the privilege escalation vulnerability in SCALANCE LPE9403 devices.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote authenticated privilege escalation flaw (CWE-273) allowing low-priv users to gain higher privileges on the device, directly enabling T1068 Exploitation for Privilege Escalation.
NVD Description
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the elevation of privileges required to perform certain valid functionality. This could allow an authenticated lowly-privileged remote attacker to escalate their…
more
privileges.
Deeper analysisAI
CVE-2025-27396 is a privilege escalation vulnerability affecting Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) in all versions prior to V4.0. The flaw stems from the affected devices not properly limiting the elevation of privileges required to perform certain valid functionality, mapped to CWE-273. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-11.
An authenticated remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation allows privilege escalation, enabling high impacts on confidentiality, integrity, and availability.
Siemens has published security advisory SSA-075201 at https://cert-portal.siemens.com/productcert/html/ssa-075201.html, which details mitigations for this issue.
Details
- CWE(s)