CVE-2025-40808: SIPROTEC 5 File Upload Vulnerability in Siemens Protective Relays

Technical summary

CVE-2025-40808 is a CWE-434 unrestricted file upload vulnerability in SIPROTEC 5 relays. The DIGSI 5 protocol, used for device configuration and management, fails to adequately validate uploaded files. An authenticated user can circumvent file type or content restrictions, uploading configuration payloads that the device will process with operational privileges. This affects all versions of 50+ device variants spanning the 6MD and 7-series relay families (protection, metering, and multi-function models) across CP050 through CP300 control processor generations. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) reflecting the authentication requirement and local/adjacent network access constraint, offset by high impact on integrity and availability.

Business impact

Power utilities and industrial facilities relying on SIPROTEC 5 relays for grid protection face operational continuity risk. An insider threat or compromised contractor account could trigger relay malfunction or shutdown, affecting protection logic during faults and potentially causing cascading outages. Malicious configuration could disable alarming, alter trip setpoints, or corrupt firmware checksums. While the CVSS score is moderate due to authentication, the criticality of protective relay function in electrical infrastructure elevates business risk. Extended downtime for relay reconfiguration or replacement represents significant cost and safety exposure.

Affected systems

All versions of 50+ SIPROTEC 5 relay models are affected, including protection relays (7SA, 7SD, 7SJ, 7SK, 7SL, 7ST, 7SX, 7SY series), metering relays (6MD, 6MU, 7UM), and differential/multi-function relays (7SS, 7VE, 7VK, 7VU, 7UT, 7KE). Affected control processors range from CP050 (compact models) through CP300. Every firmware version of these device-processor combinations is vulnerable; no patched versions are available from the vendor at this time per source data. Organizations should inventory SIPROTEC 5 deployments and verify exact device model and processor type via DIGSI 5 or physical nameplate inspection.

Exploitability

Exploitation requires valid DIGSI 5 protocol credentials, limiting attack surface to personnel with device access rights—system administrators, protection engineers, authorized contractors, or potentially compromised operator accounts. No network-based exploitation is possible; access is restricted to the adjacent local area network or directly connected engineering workstation. The attack itself is low-friction: uploading a crafted configuration file through the standard management interface requires no special tools beyond DIGSI 5 client software and valid authentication. The vulnerability is not known to be actively exploited in the wild or listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Siemens has not issued firmware patches for this vulnerability. Mitigation strategies focus on access control and network segmentation. Restrict DIGSI 5 protocol access to trusted engineering networks, using firewall rules to prevent unauthorized access from general IT infrastructure. Limit DIGSI 5 client installation and usage to designated protection engineers and system administrators. Implement multi-factor authentication or hardware token-based access controls where available in your environment. Monitor DIGSI 5 traffic for unusual configuration uploads or failed authentication attempts. Monitor Siemens security advisories for patches; affected devices may require firmware updates when available from the vendor.

Patch guidance

As of the vulnerability publication date (June 9, 2026), Siemens has not released patches. Consult Siemens ProductCERT advisories and the SIPROTEC 5 support portal for firmware release notes and scheduled patching timelines. Patching will likely require staging in a test environment given the criticality of protective relays in production. Coordinate with your Siemens field service team to validate patch applicability to your specific device variants and firmware versions before deployment to operational devices.

Detection guidance

Monitor for suspicious DIGSI 5 protocol activity: unusual file uploads, configuration changes by unauthorized accounts, or uploads from unexpected network locations. Review device configuration audit logs for unexpected changes to protection settings, trip setpoints, or firmware checksums. Network intrusion detection signatures for DIGSI 5 upload commands may be developed by your IDS vendor or security team. Collect baseline configurations of all SIPROTEC 5 relays and periodically verify integrity against known-good copies. Alert on configuration file modifications that deviate from maintenance windows.

Why prioritize this

Although the CVSS score is 6.1 (Medium), prioritize this vulnerability in critical infrastructure and power generation environments where relay malfunction directly threatens public safety and economic continuity. The broad scope (50+ device models, all versions) and the insider-threat or supply-chain compromise vectors warrant immediate access control hardening and inventory actions. Organizations in less critical industrial segments may defer intensive patching efforts until vendor patches are available, but should implement network-based controls immediately.

Risk score, explained

The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) reflects: adjacent network access only (AV:A), no attack complexity (AC:L), high privilege requirement (PR:H) limiting the threat actor pool, no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), but high integrity and availability impact (I:H/A:H). The score of 6.1 sits at the boundary of Medium severity because the authentication requirement significantly constrains exploitability, yet the integrity and availability impact on a safety-critical system justifies heightened organizational concern beyond the numerical score.

Frequently asked questions