CVE-2025-40774 Details
Description
A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users with administrative privileges, allowing them to recover passwords. Successful exploitation of this vulnerability allows an attacker to obtain and use valid user passwords. This can lead to unauthorized access to user accounts, data breaches, and potential system compromise.
A vulnerability exists in SiPass integrated versions prior to 3.0, where server applications store user passwords encrypted in the database. Decryption keys are accessible to users with administrative privileges, enabling them to recover passwords. Exploitation of this vulnerability allows an attacker to obtain valid user passwords, leading to unauthorized access to user accounts, data breaches, and potential system compromise.
Users are advised to update to SiPass integrated version 3.0 or later. For further recommendations, consult the Siemens Security Advisory SSA-599451.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-599451.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-257 | Storing Passwords in a Recoverable Format | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| siemens sipass integrated | < 3.00 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Oct 14, 2025 | New CVE Received | [email protected] |