CVE-2025-40942
Published: 13 January 2026
Summary
CVE-2025-40942 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Siemens Telecontrol Server Basic. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-40942 is a local privilege escalation vulnerability (CWE-250) affecting TeleControl Server Basic in all versions prior to V3.1.2.4. The flaw exists in the affected application and enables an attacker to execute arbitrary code with elevated privileges. It has a CVSS v3.1 base score of 8.8, rated as AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability with a change in scope.
Exploitation requires local access to the system and low privileges (PR:L), with low attack complexity and no user interaction needed. A successful attack allows the adversary to escalate privileges and run arbitrary code, potentially leading to full system compromise on the affected TeleControl Server Basic installation.
Mitigation details are provided in the Siemens Security Advisory SSA-192617, available at https://cert-portal.siemens.com/productcert/html/ssa-192617.html. Security practitioners should consult this advisory for patching instructions and additional recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2361
Vulnerability details
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via software vulnerability enabling arbitrary code execution as root/admin.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the privilege escalation vulnerability by remediating the flaw through patching to TeleControl Server Basic V3.1.2.4 or later as specified in the Siemens advisory.
Enforces least privilege for users and processes, preventing low-privilege attackers from successfully escalating to elevated privileges via the vulnerability.
Enforces approved access control policies at the system level, limiting the ability of local low-privilege attackers to escalate privileges through the application's flaw.