CVE-2025-40820Network attack vector

TCP service disruption via permissive sequence validation

Published Dec 9, 2025 · Updated Dec 9, 2025

TCP sequence validation in Siemens industrial products allows remote attackers to disrupt TCP connection setup with spoofed packets. The InterNiche IP stack accepts incoming TCP sequence numbers across an overly broad range instead of enforcing the expected value. Exploitation requires precisely timed injection of packets with spoofed source addresses and affects only exposed TCP-based services.

CVSS severity8.7
High
EPSS probability0.49%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

TCP sequence validation in Siemens industrial products allows remote attackers to disrupt TCP connection setup with spoofed packets. The InterNiche IP stack accepts incoming TCP sequence numbers across an overly broad range instead of enforcing the expected value. Exploitation requires precisely timed injection of packets with spoofed source addresses and affects only exposed TCP-based services.

The record

CVE
CVE-2025-40820
Published
Dec 9, 2025
Updated
Dec 9, 2025
Vendor
Siemens
Product
SIMATIC TDC CPU555
Classifications
CWE-940, T0814
Attack vector
network
Privileges
unauthenticated

Timeline

How it unfolded

  1. Dec 9, 2025CVE publishedPublication date reported by the CVE source.
  2. Dec 9, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=0 <*

What conditions does exploitation require?

Attack vectornetwork
Required privilegesunauthenticated

What is affected?

Siemens · SIMATIC TDC CPU555version=0 <*
Siemens · SIMATIC ET 200eco PNversion=V5.1.1 <*
Siemens · SIMATIC ET 200eco PN, DI 16x24VDC, M12-Lversion=V5.1.1 <*
Siemens · SIMATIC S7-200 SMART CPU ST20version=0 <*
Siemens · SIMATIC S7-300 CPU 317T-3 PN/DPversion=0 <*
Siemens · SIPLUS HCS4200 CIM4210Cversion=0 <*
Siemens · SIPLUS S7-1200version=0 <V4.4.0
Siemens · SIPLUS S7-1200 CPU 1215 AC/DC/RLYversion=0 <V4.4.0
Siemens · SIDOOR ATE530G COATEDversion=0 <*
Siemens · SIMATIC S7-200 SMART CPU SR40version=0 <*
Siemens · SIPLUS ET 200MP IM 155-5 PN HFversion=V4.2.0 <*
Siemens · SIMATIC S7-400 H V6 CPU familyversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1214C AC/DC/RLYversion=0 <V4.4.0
Siemens · SIMATIC S7-400 CPU 416F-3 PN/DPversion=0 <*
Siemens · SIMATIC S7-1200 CPU 1212C AC/DC/Rlyversion=0 <V4.4.0
Siemens · SIMATIC S7-200 SMART CPU SR20version=0 <*
Siemens · SIPLUS HCS4200 CIM4210version=0 <*
Siemens · SIPLUS S7-1200 CPU 1215C DC/DC/DCversion=0 <V4.4.0
Siemens · SIPLUS S7-300 CPU 314C-2 PN/DPversion=0 <*
Siemens · SIMATIC ET 200MP IM 155-5 PN HFversion=V4.2.0 <*
Siemens · SIPLUS S7-1200 CPU 1215FC DC/DC/DCversion=0 <V4.4.0
Siemens · SIDOOR ATD430Wversion=0 <*
Siemens · SIMATIC S7-200 SMART CPU ST40version=0 <*
Siemens · SIPLUS S7-1200 CPU 1215C DC/DC/RLYversion=0 <V4.4.0
Siemens · SIPLUS NET PN/PN Couplerversion=0 <V6.0.0
Siemens · SIMATIC S7-1200 CPU 1217C DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC S7-300 CPU 319-3 PN/DPversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1212C DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)version=0 <V8.3
Siemens · SIMATIC S7-1500 CPU 1516-3 PN/DPversion=0 <*
Siemens · SIMATIC S7-300 CPU 314C-2 PN/DPversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1212 AC/DC/RLYversion=0 <V4.4.0
Siemens · SIMATIC ET 200SP IM 155-6 PN HFversion=V4.2.0 <*
Siemens · SIMATIC S7-1200 CPU 1211C DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC S7-1200 CPU 1212FC DC/DC/Rlyversion=0 <V4.4.0
Siemens · SIMATIC S7-200 SMART CPU SR60version=0 <*
Siemens · SIMATIC ET 200S IM 151-8F PN/DP CPUversion=0 <*
Siemens · SIMATIC ET 200eco PN, DI 8x24VDC, M12-Lversion=V5.1.1 <*
Siemens · SIMATIC S7-1500 CPU 1511F-1 PNversion=0 <*
Siemens · SIMATIC ET 200SP IM 155-6 PN HAversion=0 <V1.3
Siemens · SIMATIC S7-200 SMART CPU CR40version=0 <*
Siemens · SIMATIC CFU PAversion=0 <V2.0.0
Siemens · SIPLUS S7-300 CPU 315F-2 PN/DPversion=0 <*
Siemens · SIMATIC S7-1500 CPU 1513-1 PNversion=0 <*
Siemens · SIMATIC S7-300 CPU 319F-3 PN/DPversion=0 <*
Siemens · SIMATIC ET 200SP IM 155-6 PN/2 HFversion=V4.2.0 <*
Siemens · SIMATIC S7-1500 CPU 1516F-3 PN/DPversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1214C DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC ET 200eco PN, AI 8xRTD/TC, M12-Lversion=V5.1.1 <*
Siemens · SIPLUS S7-300 CPU 317F-2 PN/DPversion=0 <*
Siemens · SIMATIC S7-200 SMART CPU ST60version=0 <*
Siemens · SIPLUS S7-1200 CPU 1215C AC/DC/RLYversion=0 <V4.4.0
Siemens · SIMATIC PN/MF Couplerversion=0 <*
Siemens · SIPLUS ET 200S IM 151-8F PN/DP CPUversion=0 <*
Siemens · SIMATIC ET 200clean, DIQ 16x24VDC/0,5Aversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1214C DC/DC/RLYversion=0 <V4.4.0
Siemens · SIMATIC S7-300 CPU 315F-2 PN/DPversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1215 DC/DC/DCversion=0 <V4.4.0
Siemens · SIPLUS ET 200MP IM 155-5 PN HF T1 RAILversion=V4.2.0 <*
Siemens · SIPLUS ET 200SP IM 155-6 PN HFversion=V4.2.0 <*
Siemens · SIMATIC S7-1200 CPU 1211C AC/DC/Rlyversion=0 <V4.4.0
Siemens · SIPLUS HCS4300 CIM4310version=0 <*
Siemens · SIMATIC S7-410 CPU familyversion=0 <V10.2
Siemens · SIMATIC S7-1200 CPU 1214C AC/DC/Rlyversion=0 <V4.4.0
Siemens · SIMATIC S7-1500 CPU 1511-1 PNversion=0 <*
Siemens · SIPLUS S7-1500 CPU 1511F-1 PNversion=0 <*
Siemens · SIMATIC ET 200SP IM 155-6 PN/3 HFversion=V4.2.0 <*
Siemens · SIPLUS S7-1200 CPU 1214C DC/DC/DC RAILversion=0 <V4.4.0
Siemens · SIMATIC S7-200 SMART CPU ST30version=0 <*
Siemens · SIMATIC ET 200SP CPU 1510SP F-1 PNversion=0 <*
Siemens · SIMATIC S7-1500 CPU 1513F-1 PNversion=0 <*
Siemens · SIMATIC Power Line Booster PLB, Base Moduleversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1214FC DC/DC/RLYversion=0 <V4.4.0
Siemens · SIWAREX WP522 STversion=0 <*
Siemens · SIMATIC S7-1200 CPU 1212FC DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC S7-400 CPU 416-3 PN/DP V7version=0 <*
Siemens · SIMATIC ET 200SP IM 155-6 MF HFversion=0 <*
Siemens · SIPLUS S7-1500 CPU 1513-1 PNversion=0 <*
Siemens · SIPLUS S7-1500 CPU 1516F-3 PN/DPversion=0 <*
Siemens · SIMATIC ET 200clean DI 16x24VDCversion=0 <*
Siemens · SIPLUS S7-400 CPU 416-3 PN/DPversion=0 <*
Siemens · SIPLUS S7-1500 CPU 1513F-1 PNversion=0 <*
Siemens · SIMATIC S7-300 CPU 315T-3 PN/DPversion=0 <*
Siemens · SIMATIC ET 200SP CPU 1512SP F-1 PNversion=0 <*
Siemens · SIMATIC ET 200AL IM 157-1 PNversion=0 <*
Siemens · SIPLUS S7-1500 CPU 1516-3 PN/DPversion=0 <*
Siemens · SIMATIC ET 200eco PN DQ 8x24VDC/2A M12-Lversion=V5.1.1 <*
Siemens · SIMATIC ET 200pro IM 154-8FX PN/DP CPUversion=0 <*
Siemens · SIMATIC S7-200 SMART CPU CR60version=0 <*
Siemens · SIMATIC S7-1200 CPU 1212C DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC Power Line Booster PLB, Modem Module STversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1214 AC/DC/RLYversion=0 <V4.4.0
Siemens · SIPLUS S7-1200 CPU 1212C AC/DC/RLYversion=0 <V4.4.0
Siemens · SIPLUS S7-1200 CPU 1212 DC/DC/RLYversion=0 <V4.4.0
Siemens · SIMATIC S7-1200 CPU 1211C DC/DC/Rlyversion=0 <V4.4.0
Siemens · SIPLUS S7-1500 CPU 1511-1 PNversion=0 <*
Siemens · SIMOCODE pro V EtherNet/IPversion=0 <*
Siemens · SIMATIC S7-300 CPU 315-2 PN/DPversion=0 <*
Siemens · SIMATIC S7-1200 CPU 1215FC DC/DC/DCversion=0 <V4.4.0
Siemens · SIMATIC S7-1500 CPU 1515F-2 PNversion=0 <*
Siemens · SIMATIC S7-1200version=0 <V4.4.0
Siemens · SIMATIC S7-1200 CPU 1215C DC/DC/DCversion=0 <V4.4.0
Siemens · SIPLUS ET 200S IM 151-8 PN/DP CPUversion=0 <*
Siemens · SIPLUS S7-300 CPU 315-2 PN/DPversion=0 <*
Siemens · SIMATIC ET 200SP CPU 1512SP-1 PNversion=0 <*
Siemens · SIPLUS S7-400 CPU 414-3 PN/DP V7version=0 <*
Siemens · SIMATIC S7-200 SMART CPU SR30version=0 <*
Siemens · SINUMERIK 840D slversion=0 <*
Siemens · SIMATIC S7-1200 CPU 1212C DC/DC/RLYversion=0 <V4.4.0
Siemens · SIMATIC S7-300 CPU 317F-2 PN/DPversion=0 <*
Siemens · SIMATIC S7-400 CPU 414-3 PN/DP V7version=0 <*
Siemens · SIPLUS ET 200SP IM 155-6 PN HF T1 RAILversion=V4.2.0 <*
Siemens · SIMATIC S7-300 CPU 317TF-3 PN/DPversion=0 <*
Siemens · SIMATIC ET 200cleanversion=0 <*
Siemens · SIMATIC S7-1200 CPU 1215C DC/DC/Rlyversion=0 <V4.4.0
Siemens · SIMATIC TDC CP51M1version=0 <*
Siemens · SIPLUS S7-300 CPU 317-2 PN/DPversion=0 <*
Siemens · SIMATIC S7-400 CPU 414F-3 PN/DP V7version=0 <*
Siemens · SIMATIC ET 200eco PN, DQ 8x24VDC/0,5A, M12-Lversion=V5.1.1 <*
Siemens · SIMATIC PN/PN Couplerversion=0 <V6.0.0
Siemens · SIMATIC S7-300 CPU 317-2 PN/DPversion=0 <*
Siemens · SIWAREX WP241version=0 <*
Siemens · SIMATIC S7-1500 CPU 1515-2 PNversion=0 <*
Siemens · SIPLUS S7-1200 CPU 1212C DC/DC/DC RAILversion=0 <V4.4.0
Siemens · SIPLUS ET 200SP IM 155-6 PN HF TX RAILversion=V4.2.0 <*
Siemens · SIWAREX WP251version=0 <*
Siemens · SIMATIC S7-1200 CPU 1214C DC/DC/DCversion=0 <V4.4.0
Siemens · SIWAREX WP521 STversion=0 <*
Siemens · SIMATIC S7-1200 CPU 1214C DC/DC/Rlyversion=0 <V4.4.0
Siemens · SIMATIC S7-1200 CPU 1214FC DC/DC/DCversion=0 <V4.4.0
Siemens · SIDOOR ATE530Sversion=0 <*
Siemens · SIMATIC CFU DIQversion=0 <V2.0.0
Siemens · SIMATIC S7-1200 CPU 1214FC DC/DC/Rlyversion=0 <V4.4.0
Siemens · SIMATIC ET 200pro IM 154-8 PN/DP CPUversion=0 <*
Siemens · SIMOCODE pro V PROFINETversion=0 <*
Siemens · SIMATIC ET 200S IM 151-8 PN/DP CPUversion=0 <*
Siemens · SIWAREX WP231version=0 <*
Siemens · SIMATIC ET 200SP CPU 1510SP-1 PNversion=0 <*
Siemens · SIPLUS ET 200SP CPU 1512SP F-1 PNversion=0 <*
Siemens · SIMATIC ET 200pro IM 154-8F PN/DP CPUversion=0 <*
Siemens · SIMATIC S7-400 CPU 412-2 PN V7version=0 <*

Published CVSS scores

7.5Siemens AGCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7Siemens AGCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesunauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-940Improper Verification of Source of a Communication Channel
T0814Denial of Service

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo