CVE-2025-40942

HighLPE

Published: 13 January 2026

Published

13 January 2026

Modified

22 January 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0001 0.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40942 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Siemens Telecontrol Server Basic. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the privilege escalation vulnerability by remediating the flaw through patching to TeleControl Server Basic V3.1.2.4 or later as specified in the Siemens advisory.

AC-6 Least Privilege good match

prevent

Enforces least privilege for users and processes, preventing low-privilege attackers from successfully escalating to elevated privileges via the vulnerability.

AC-3 Access Enforcement partial match

prevent

Enforces approved access control policies at the system level, limiting the ability of local low-privilege attackers to escalate privileges through the application's flaw.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct local privilege escalation via software vulnerability enabling arbitrary code execution as root/admin.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges.

Deeper analysisAI

CVE-2025-40942 is a local privilege escalation vulnerability (CWE-250) affecting TeleControl Server Basic in all versions prior to V3.1.2.4. The flaw exists in the affected application and enables an attacker to execute arbitrary code with elevated privileges. It has a CVSS v3.1 base score of 8.8, rated as AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability with a change in scope.

Exploitation requires local access to the system and low privileges (PR:L), with low attack complexity and no user interaction needed. A successful attack allows the adversary to escalate privileges and run arbitrary code, potentially leading to full system compromise on the affected TeleControl Server Basic installation.

Mitigation details are provided in the Siemens Security Advisory SSA-192617, available at https://cert-portal.siemens.com/productcert/html/ssa-192617.html. Security practitioners should consult this advisory for patching instructions and additional recommendations.