Siemens Scalance LPE9403 Firmware vulnerabilities

27 CVEs affecting Siemens Scalance LPE9403 Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40583, published 2025-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, published 2022-01-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.9% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users…
CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability, published 2022-03-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 92.8% chance of exploitation in the next 30 days. A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2021-36221, published 2021-08-08. Medium severity, CVSS 5.9. EPSS: 3.1% chance of exploitation in the next 30 days. Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
CVE-2023-27407, published 2023-05-09. Critical severity, CVSS 9.9. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command…
CVE-2025-27394, published 2025-03-11. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new SNMP users. This could…
CVE-2025-27393, published 2025-03-11. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new users. This could allow an…
CVE-2025-27392, published 2025-03-11. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new VXLAN configurations. This…
CVE-2025-27395, published 2025-03-11. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the scope of files accessible through and the privileges of…
CVE-2023-27410, published 2023-05-09. Low severity, CVSS 2.7. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A heap-based buffer overflow vulnerability was found in the `edgebox_web_app` binary. The binary will crash if supplied…

Latest

CVE-2025-40583, published 2025-05-13. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affected devices do transmit sensitive…
CVE-2025-40582, published 2025-05-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affected devices do not properly sanitize…
CVE-2025-40581, published 2025-05-13. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affected devices are vulnerable to an…
CVE-2025-40580, published 2025-05-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-based buffer overflow. This could allow a…
CVE-2025-40579, published 2025-05-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-based buffer overflow. This could allow a…
CVE-2025-40578, published 2025-05-13. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). Affected devices do not properly handle multiple incoming Profinet packets received in rapid…
CVE-2025-40577, published 2025-05-13. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote…
CVE-2025-40576, published 2025-05-13. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote…
CVE-2025-40575, published 2025-05-13. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote…
CVE-2025-40574, published 2025-05-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to critical ressources. This could allow a…