Siemens Sinumerik 840d Sl vulnerabilities

7 CVEs affecting Siemens Sinumerik 840d Sl, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40833, published 2026-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10936, published 2019-10-10. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Affected devices improperly handle large amounts of specially crafted UDP packets. This could allow an unauthenticated remote attacker to trigger a denial of service condition.
CVE-2019-18336, published 2020-03-10. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (All versions < V1.1.8), SIMATIC TDC…
CVE-2019-10923, published 2019-10-10. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IRT) of the affected installation.
CVE-2024-23814, published 2025-02-11. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment…
CVE-2025-40820, published 2025-12-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to…
CVE-2025-40833, published 2026-05-12. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual…
CVE-2025-40743, published 2025-08-12. High severity, CVSS 8.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All versions < V4.95 SP5), SINUMERIK MC…