CVE-2025-40817

MediumCVSS 6.5

Published: 11/11/2025(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability has been identified in LOGO! and SIPLUS LOGO! devices (all versions before V1.84.05) due to lack of certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently.

Risk Assessment

Changing device time could disrupt control systems, potentially leading to unpredictable behavior or failures.

Recommendation

Update LOGO! device firmware to version V1.84.05 or later and restrict remote access.

Other vulnerabilities in Siemens LOGO!

CVE-2025-40815High
In LOGO! devices (including SIPLUS variants) with versions prior to V1.84.05, there is a vulnerability due to improper validation of TCP packet structures in several methods. This could allow an attacker to cause buffer overflows, gain control over the instruction counter, and run custom code.

Original NVD description (English source)

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions < V1.84.05), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions < V1.84.05), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions < V1.84.05), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions < V1.84.05), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions < V1.84.05), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions < V1.84.05), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions < V1.84.05). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS