CVE-2025-40806
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gridscale | gridscale_x_prepay | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability can be detected by observing distinguishable responses from the Gridscale X Prepay application when attempting to verify usernames remotely. This involves sending authentication or user validation requests and analyzing the responses to determine if user enumeration is possible. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating Gridscale X Prepay to version 4.2.1 or later, as recommended by Siemens. Additionally, protect network access using firewalls, segmentation, and VPNs configured according to Siemens operational guidelines. Ensure updates are applied using Siemens-provided tools and procedures, validate updates before deployment, and supervise the update process by trained personnel. [1]
Can you explain this vulnerability to me?
This vulnerability in Gridscale X Prepay (all versions before V4.2.1) allows an unauthenticated remote attacker to perform user enumeration by analyzing distinguishable responses from the application. This means the attacker can determine whether a user exists or not, which can then be used to carry out brute force attacks on valid user accounts.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to identify valid user accounts without authentication, increasing the risk of brute force attacks. This can lead to unauthorized access attempts and potential compromise of user accounts.