CVE-2025-40746
Published: 12 August 2025
Summary
CVE-2025-40746 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Siemens Simatic Rtls Locating Manager. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 16.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability identified as CVE-2025-40746 affects Siemens SIMATIC RTLS Locating Manager in all versions prior to V3.2. The products do not properly validate input for a backup script, which is tracked under CWE-20 and carries a CVSS 4.0 score of 9.4.
An authenticated remote attacker who already possesses high privileges within the application can supply crafted input to the backup script and thereby execute arbitrary code with NT Authority/SYSTEM privileges on the underlying system.
The official Siemens advisory at https://cert-portal.siemens.com/productcert/html/ssa-493787.html addresses the issue and outlines mitigation steps for affected deployments.
The associated EPSS score remains low and unchanged at 0.0182, indicating no material increase in observed exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24244
Vulnerability details
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute…
more
arbitrary code with 'NT Authority/SYSTEM' privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation in backup script directly enables authenticated remote attacker to achieve arbitrary code execution and escalate from application high privileges to NT AUTHORITY/SYSTEM.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly requires validation of inputs to the backup script to ensure consistency with expected content, addressing the core CWE-20 improper input validation vulnerability.
SI-2 mandates identification, reporting, and timely remediation of flaws like this input validation issue, enabling patching to V3.2 as recommended in the advisory.
AC-6 enforces least privilege to limit the scope of high-privilege accounts that could access and exploit the vulnerable backup script, reducing potential for SYSTEM-level code execution.