CVE-2025-40751

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-707630.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*

History

20 Aug 2025, 20:57

Type	Values Removed	Values Added
CPE		cpe:2.3:a:siemens:simatic_rtls_locating_manager::::::::
Summary		(es) Se ha identificado una vulnerabilidad en SIMATIC RTLS Locating Manager (todas las versiones anteriores a la V3.3). Los clientes de informes de SIMATIC RTLS Locating Manager afectados no protegen adecuadamente las credenciales utilizadas para la autenticación en el servidor. Esto podría permitir que un atacante local autenticado extraiga las credenciales y las utilice para escalar sus derechos de acceso del rol de administrador al de administrador del sistema.
First Time		Siemens Siemens simatic Rtls Locating Manager
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-707630.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-707630.html - Vendor Advisory

12 Aug 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-12 12:15

Updated : 2025-08-20 20:57

NVD link : CVE-2025-40751

Mitre link : CVE-2025-40751

CVE.ORG link : CVE-2025-40751

JSON object : View

Products Affected

siemens

simatic_rtls_locating_manager

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2025-40751", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-12T12:15:36.190", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-707630.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC RTLS Locating Manager (todas las versiones anteriores a la V3.3). Los clientes de informes de SIMATIC RTLS Locating Manager afectados no protegen adecuadamente las credenciales utilizadas para la autenticaci\u00f3n en el servidor. Esto podr\u00eda permitir que un atacante local autenticado extraiga las credenciales y las utilice para escalar sus derechos de acceso del rol de administrador al de administrador del sistema."}], "lastModified": "2025-08-20T20:57:21.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E176308-5FE8-46E5-B001-E2E52FCEC76E", "versionEndExcluding": "3.3"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}