CVE-2025-40820
High
Description
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSIDOOR ATD430W
PublishedDec 9, 2025
First seenDec 9, 2025
Weakness typeCWE-940CWE-940
How to fix
Update
- Siemens SIMATIC CFU DIQV2.0.0 or later
- Siemens SIMATIC CFU PAV2.0.0 or later
- Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)V1.3 or later
- Siemens SIMATIC PN/PN CouplerV6.0.0 or later
- Siemens SIMATIC S7-1200 CPU 1211C AC/DC/RlyV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DCV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1211C DC/DC/RlyV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1212C AC/DC/RlyV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DCV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1212C DC/DC/RlyV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DCV4.4.0 or later
- Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/RlyV4.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens SIDOOR ATD430W | 0 | — |
| Siemens SIDOOR ATE530G COATED | 0 | — |
| Siemens SIDOOR ATE530S COATED | 0 | — |
| Siemens SIMATIC CFU DIQ | v < V2.0.0 | V2.0.0 |
| Siemens SIMATIC CFU PA | v < V2.0.0 | V2.0.0 |
| Siemens SIMATIC ET 200AL IM 157-1 PN | 0 | — |
| Siemens SIMATIC ET 200clean, CM 8x IO-Link | 0 | — |
| Siemens SIMATIC ET 200clean, DI 16x24VDC | 0 | — |
| Siemens SIMATIC ET 200clean, DIQ 16x24VDC/0,5A | 0 | — |
| Siemens SIMATIC ET 200eco PN, AI 8xRTD/TC, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, CM 4x IO-Link, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, CM 8x IO-Link, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, DI 16x24VDC, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, DI 8x24VDC, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, DIQ 16x24VDC/2A, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, DQ 8x24VDC/0,5A, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200eco PN, DQ 8x24VDC/2A, M12-L | V5.1.1 | — |
| Siemens SIMATIC ET 200MP IM 155-5 PN HF | V4.2.0 | — |
| Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU | 0 | — |
| Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU | 0 | — |
| Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU | 0 | — |
| Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU | 0 | — |
| Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU | 0 | — |
| Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN | 0 | — |
| Siemens SIMATIC ET 200SP CPU 1510SP-1 PN | 0 | — |
| Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN | 0 | — |
| Siemens SIMATIC ET 200SP CPU 1512SP-1 PN | 0 | — |
| Siemens SIMATIC ET 200SP IM 155-6 MF HF | 0 | — |
| Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) | v < V1.3 | V1.3 |
| Siemens SIMATIC ET 200SP IM 155-6 PN HF | V4.2.0 | — |
| Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF | V4.2.0 | — |
| Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF | V4.2.0 | — |
| Siemens SIMATIC PN/MF Coupler | 0 | — |
| Siemens SIMATIC PN/PN Coupler | v < V6.0.0 | V6.0.0 |
| Siemens SIMATIC Power Line Booster PLB, Base Module | 0 | — |
| Siemens SIMATIC Power Line Booster PLB, Modem Module ST | 0 | — |
| Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1214C AC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1214C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1214C DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1214FC DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1215C AC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1215C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1215C DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1215FC DC/DC/Rly | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1200 CPU 1217C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIMATIC S7-1500 CPU 1511-1 PN | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1511F-1 PN | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1513-1 PN | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1513F-1 PN | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1515-2 PN | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1515F-2 PN | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-1500 CPU 1516F-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU CR40 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU CR60 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU SR20 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU SR30 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU SR40 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU SR60 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU ST20 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU ST30 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU ST40 | 0 | — |
| Siemens SIMATIC S7-200 SMART CPU ST60 | 0 | — |
| Siemens SIMATIC S7-300 CPU 314C-2 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 315-2 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 315F-2 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 315T-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 317-2 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 317F-2 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 317T-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 319-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-300 CPU 319F-3 PN/DP | 0 | — |
| Siemens SIMATIC S7-400 CPU 412-2 PN V7 | 0 | — |
| Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7 | 0 | — |
| Siemens SIMATIC S7-400 CPU 414F-3 PN/DP V7 | 0 | — |
| Siemens SIMATIC S7-400 CPU 416-3 PN/DP V7 | 0 | — |
| Siemens SIMATIC S7-400 CPU 416F-3 PN/DP V7 | 0 | — |
| Siemens SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) | 0 | — |
| Siemens SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) | v < V10.2 | V10.2 |
| Siemens SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) | v < V8.3 | V8.3 |
| Siemens SIMATIC TDC CP51M1 | 0 | — |
| Siemens SIMATIC TDC CPU555 | 0 | — |
| Siemens SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants) | 0 | — |
| Siemens SIMOCODE pro V PROFINET | 0 | — |
| Siemens SINUMERIK 840D sl | 0 | — |
| Siemens SIPLUS ET 200MP IM 155-5 PN HF | V4.2.0 | — |
| Siemens SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL | V4.2.0 | — |
| Siemens SIPLUS ET 200S IM 151-8 PN/DP CPU | 0 | — |
| Siemens SIPLUS ET 200S IM 151-8F PN/DP CPU | 0 | — |
| Siemens SIPLUS ET 200SP CPU 1512SP F-1 PN | 0 | — |
| Siemens SIPLUS ET 200SP IM 155-6 PN HF | V4.2.0 | — |
| Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL | V4.2.0 | — |
| Siemens SIPLUS ET 200SP IM 155-6 PN HF TX RAIL | V4.2.0 | — |
| Siemens SIPLUS HCS4200 CIM4210 | 0 | — |
| Siemens SIPLUS HCS4200 CIM4210C | 0 | — |
| Siemens SIPLUS HCS4300 CIM4310 | 0 | — |
| Siemens SIPLUS NET PN/PN Coupler | v < V6.0.0 | V6.0.0 |
| Siemens SIPLUS S7-1200 CPU 1212 AC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1212 DC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1212C AC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1212C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214 AC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214 DC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214C AC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214C DC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214FC DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1214FC DC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1215 AC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1215 DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1215 DC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1215C AC/DC/RLY | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1215C DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1200 CPU 1215FC DC/DC/DC | v < V4.4.0 | V4.4.0 |
| Siemens SIPLUS S7-1500 CPU 1511-1 PN | 0 | — |
| Siemens SIPLUS S7-1500 CPU 1511F-1 PN | 0 | — |
| Siemens SIPLUS S7-1500 CPU 1513-1 PN | 0 | — |
| Siemens SIPLUS S7-1500 CPU 1513F-1 PN | 0 | — |
| Siemens SIPLUS S7-1500 CPU 1516-3 PN/DP | 0 | — |
| Siemens SIPLUS S7-1500 CPU 1516F-3 PN/DP | 0 | — |
| Siemens SIPLUS S7-300 CPU 314C-2 PN/DP | 0 | — |
| Siemens SIPLUS S7-300 CPU 315-2 PN/DP | 0 | — |
| Siemens SIPLUS S7-300 CPU 315F-2 PN/DP | 0 | — |
| Siemens SIPLUS S7-300 CPU 317-2 PN/DP | 0 | — |
| Siemens SIPLUS S7-300 CPU 317F-2 PN/DP | 0 | — |
| Siemens SIPLUS S7-400 CPU 414-3 PN/DP V7 | 0 | — |
| Siemens SIPLUS S7-400 CPU 416-3 PN/DP V7 | 0 | — |
| Siemens SIWAREX WP231 | 0 | — |
| Siemens SIWAREX WP241 | 0 | — |
| Siemens SIWAREX WP251 | 0 | — |
| Siemens SIWAREX WP521 ST | 0 | — |
| Siemens SIWAREX WP522 ST | 0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.