CVE-2025-40942
Local Privilege Escalation in TeleControl Server Basic < V
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | telecontrol_server_basic | to 3.1.2.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Siemens TeleControl Server Basic (versions prior to V3.1.2.4) is a local privilege escalation flaw that allows an attacker with local access to execute arbitrary code with elevated privileges. This means an attacker who already has some access to the system can gain higher-level permissions and potentially take full control of the affected system. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to compromise the confidentiality, integrity, and availability of your system. Since the attacker can execute arbitrary code with elevated privileges, they could manipulate, steal, or destroy data, disrupt system operations, or install malicious software, leading to significant security breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying the installed version of Siemens TeleControl Server Basic. If the version is prior to V3.1.2.4, the system is vulnerable. Specific detection commands are not provided in the resources. It is recommended to check the software version on the system to identify if it is affected. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update Siemens TeleControl Server Basic to version V3.1.2.4 or later. Additionally, protect network access with appropriate security mechanisms and configure the operational environment according to Siemens' Industrial Security guidelines. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information on how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.