CVE-2025-40746

Critical

Published: 12 August 2025

Published

12 August 2025

Modified

20 August 2025

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0068 71.8th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40746 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Siemens Simatic Rtls Locating Manager. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 28.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 directly requires validation of inputs to the backup script to ensure consistency with expected content, addressing the core CWE-20 improper input validation vulnerability.

SI-2 Flaw Remediation good match

prevent

SI-2 mandates identification, reporting, and timely remediation of flaws like this input validation issue, enabling patching to V3.2 as recommended in the advisory.

AC-6 Least Privilege partial match

prevent

AC-6 enforces least privilege to limit the scope of high-privilege accounts that could access and exploit the vulnerable backup script, reducing potential for SYSTEM-level code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Improper input validation in backup script directly enables authenticated remote attacker to achieve arbitrary code execution and escalate from application high privileges to NT AUTHORITY/SYSTEM.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute…

arbitrary code with 'NT Authority/SYSTEM' privileges.

Deeper analysisAI

CVE-2025-40746 is a vulnerability in SIMATIC RTLS Locating Manager, affecting all versions prior to V3.2. The flaw involves improper input validation for a backup script, classified under CWE-20 (Improper Input Validation). It was published on 2025-08-12 and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting critical severity.

An authenticated remote attacker with high privileges in the application can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary code with 'NT Authority/SYSTEM' privileges, potentially leading to full system compromise due to the high impact on confidentiality, integrity, and availability, along with a scope change.

Mitigation details are available in the Siemens security advisory at https://cert-portal.siemens.com/productcert/html/ssa-493787.html.