CVE-2025-40594 is a medium severity improper privilege management flaw (CVSS 6.3) in Siemens SINAMICS G220, S200 and S210 drives on V6.4. A factory reset can run without the right privileges. Update G220 and S210 to V6.4 HF2, and S200 to V6.4 HF7, or later, as Siemens advises.
What's affected
Siemens advisory SSA-027652 was published on 9 September 2025 and updated on 10 March 2026. It lists three products, all on V6.4:
- SINAMICS G220, all versions before V6.4 HF2. Update to V6.4 HF2 or later.
- SINAMICS S210, all versions before V6.4 HF2. Update to V6.4 HF2 or later.
- SINAMICS S200, all versions before V6.4 HF7. Update to V6.4 HF7 or later.
The March 2026 revision added the fix version for the S200, so older copies of the advisory may be incomplete. The advisory gives a CVSS v3.1 base score of 6.3 and a v4.0 score of 6.9.
Per the advisory, the devices allow a factory reset without the required privileges, because of improper privilege management, and configuration data can be changed because of leaked privileges from earlier sessions. An unauthorized attacker could use this to escalate privileges.
The vector is local and high complexity, and it needs some user interaction. This is not a flaw that can be used from the open internet, which explains the medium score.
How to check if you're exposed
- Make a list of SINAMICS G220, S200 and S210 drives in your plant. Drives are often installed once and not tracked after that.
- For each drive, read the firmware version from the engineering tool or the device interface, and compare it with the table above.
- Mark any device that runs V6.4 below the fixed level for its product line.
- Note who has local or engineering access to each drive, and how the engineering tools connect to it.
There is no operating system command for this. The device version is the check.
What to do now
- Update to V6.4 HF2 or later on G220 and S210, and to V6.4 HF7 or later on S200. Use the download links in the Siemens advisory, confirmed through your Siemens support channel.
- Plan the update with your maintenance windows, since drives control motors and processes.
- Until you have updated, limit access to the drives and the engineering stations that talk to them. Siemens recommends operating in a protected IT environment and points to its operational guidelines for industrial security.
- Restrict who can use local or engineering access, and log who did.
- Update the inventory with the new version after each change.
Why it matters
The weakness is improper privilege management, CWE-269. A function that should need a privilege, here a factory reset, can be run without it, and privileges from an earlier session stay around longer than they should.
A drive reset or a changed configuration is more than a data issue. It can stop or change a physical process. That is why even a medium score deserves a place in the maintenance plan in industrial settings.
This CVE is not on the CISA Known Exploited Vulnerabilities list. The practical risk comes from the access an attacker needs: local, with user interaction. Good network and physical controls make that harder to meet. Our free in-browser dependency scan and the Gold directory help you track software across an estate, though device firmware needs vendor advisories like this one.
Quick check
Can this be exploited from the internet?
The CVSS vector lists local access, high complexity and user interaction, so it is not a remote attack by itself. Still protect the engineering network and update the drives.
Why does the fixed version differ between products?
Siemens lists V6.4 HF2 for G220 and S210 and V6.4 HF7 for S200. Use the version for your product line.
Sources
Last reviewed: 18 October 2026.
