{"id":"CVE-2025-40820","aliases":["EUVD-2025-201923","GHSA-84r6-pwmm-h2fw"],"status":"published","title":"Affected products do not properly enforce TCP sequence number validation in specific scenarios...","description":"Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00508,"percentile":0.43906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-940"],"published":"2025-12-09T10:44:30Z","modified":"2026-10-07T11:10:00Z","products":[{"vendor":"siemens","product":"sidoor atd430w"},{"vendor":"siemens","product":"sidoor ate530g coated"},{"vendor":"siemens","product":"sidoor ate530s coated"},{"vendor":"siemens","product":"simatic cfu diq"},{"vendor":"siemens","product":"simatic cfu pa"},{"vendor":"siemens","product":"simatic et 200al im 157-1 pn"},{"vendor":"siemens","product":"simatic et 200clean, cm 8x io-link"},{"vendor":"siemens","product":"simatic et 200clean, di 16x24vdc"},{"vendor":"siemens","product":"simatic et 200clean, diq 16x24vdc/0,5a"},{"vendor":"siemens","product":"simatic et 200eco pn, ai 8xrtd/tc, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, cm 4x io-link, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, cm 8x io-link, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, di 16x24vdc, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, di 8x24vdc, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, diq 16x24vdc/2a, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, dq 8x24vdc/0,5a, m12-l"},{"vendor":"siemens","product":"simatic et 200eco pn, dq 8x24vdc/2a, m12-l"},{"vendor":"siemens","product":"simatic et 200mp im 155-5 pn hf"},{"vendor":"siemens","product":"simatic et 200pro im 154-8 pn/dp cpu"},{"vendor":"siemens","product":"simatic et 200pro im 154-8f pn/dp cpu"},{"vendor":"siemens","product":"simatic et 200pro im 154-8fx pn/dp cpu"},{"vendor":"siemens","product":"simatic et 200s im 151-8 pn/dp cpu"},{"vendor":"siemens","product":"simatic et 200s im 151-8f pn/dp cpu"},{"vendor":"siemens","product":"simatic et 200sp cpu 1510sp f-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1510sp-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1512sp f-1 pn"},{"vendor":"siemens","product":"simatic et 200sp cpu 1512sp-1 pn"},{"vendor":"siemens","product":"simatic et 200sp im 155-6 mf hf"},{"vendor":"siemens","product":"simatic et 200sp im 155-6 pn ha (incl. siplus variants)"},{"vendor":"siemens","product":"simatic et 200sp im 155-6 pn hf"},{"vendor":"siemens","product":"simatic et 200sp im 155-6 pn/2 hf"},{"vendor":"siemens","product":"simatic et 200sp im 155-6 pn/3 hf"},{"vendor":"siemens","product":"simatic pn/mf coupler"},{"vendor":"siemens","product":"simatic pn/pn coupler"},{"vendor":"siemens","product":"simatic power line booster plb, base module"},{"vendor":"siemens","product":"simatic power line booster plb, modem module st"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1211c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1211c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1211c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212fc dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1212fc dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214fc dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1214fc dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215c ac/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215c dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215fc dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1215fc dc/dc/rly"},{"vendor":"siemens","product":"simatic s7-1200 cpu 1217c dc/dc/dc"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1511f-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1513f-1 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1515f-2 pn"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1516f-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-200 smart cpu cr40"},{"vendor":"siemens","product":"simatic s7-200 smart cpu cr60"},{"vendor":"siemens","product":"simatic s7-200 smart cpu sr20"},{"vendor":"siemens","product":"simatic s7-200 smart cpu sr30"},{"vendor":"siemens","product":"simatic s7-200 smart cpu sr40"},{"vendor":"siemens","product":"simatic s7-200 smart cpu sr60"},{"vendor":"siemens","product":"simatic s7-200 smart cpu st20"},{"vendor":"siemens","product":"simatic s7-200 smart cpu st30"},{"vendor":"siemens","product":"simatic s7-200 smart cpu st40"},{"vendor":"siemens","product":"simatic s7-200 smart cpu st60"},{"vendor":"siemens","product":"simatic s7-300 cpu 314c-2 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 315-2 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 315f-2 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 315t-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 317-2 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 317f-2 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 317t-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 317tf-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 319-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-300 cpu 319f-3 pn/dp"},{"vendor":"siemens","product":"simatic s7-400 cpu 412-2 pn v7"},{"vendor":"siemens","product":"simatic s7-400 cpu 414-3 pn/dp v7"},{"vendor":"siemens","product":"simatic s7-400 cpu 414f-3 pn/dp v7"},{"vendor":"siemens","product":"simatic s7-400 cpu 416-3 pn/dp v7"},{"vendor":"siemens","product":"simatic s7-400 cpu 416f-3 pn/dp v7"},{"vendor":"siemens","product":"simatic s7-400 h v6 cpu family (incl. siplus variants)"},{"vendor":"siemens","product":"simatic s7-410 v10 cpu family (incl. siplus variants)"},{"vendor":"siemens","product":"simatic s7-410 v8 cpu family (incl. siplus variants)"},{"vendor":"siemens","product":"simatic tdc cp51m1"},{"vendor":"siemens","product":"simatic tdc cpu555"},{"vendor":"siemens","product":"simocode pro v ethernet/ip (incl. siplus variants)"},{"vendor":"siemens","product":"simocode pro v profinet"},{"vendor":"siemens","product":"sinumerik 840d sl"},{"vendor":"siemens","product":"siplus et 200mp im 155-5 pn hf"},{"vendor":"siemens","product":"siplus et 200mp im 155-5 pn hf t1 rail"},{"vendor":"siemens","product":"siplus et 200s im 151-8 pn/dp cpu"},{"vendor":"siemens","product":"siplus et 200s im 151-8f pn/dp cpu"},{"vendor":"siemens","product":"siplus et 200sp cpu 1512sp f-1 pn"},{"vendor":"siemens","product":"siplus et 200sp im 155-6 pn hf"},{"vendor":"siemens","product":"siplus et 200sp im 155-6 pn hf t1 rail"},{"vendor":"siemens","product":"siplus et 200sp im 155-6 pn hf tx rail"},{"vendor":"siemens","product":"siplus hcs4200 cim4210"},{"vendor":"siemens","product":"siplus hcs4200 cim4210c"},{"vendor":"siemens","product":"siplus hcs4300 cim4310"},{"vendor":"siemens","product":"siplus net pn/pn coupler"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212 ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212 dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212c ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212c dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1212c dc/dc/dc rail"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214 ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214 dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214c ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214c dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214c dc/dc/dc rail"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214c dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214fc dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1214fc dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215 ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215 dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215 dc/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215c ac/dc/rly"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215c dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1200 cpu 1215fc dc/dc/dc"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1511-1 pn"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1511f-1 pn"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1513-1 pn"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1513f-1 pn"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1516-3 pn/dp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1516f-3 pn/dp"},{"vendor":"siemens","product":"siplus s7-300 cpu 314c-2 pn/dp"},{"vendor":"siemens","product":"siplus s7-300 cpu 315-2 pn/dp"},{"vendor":"siemens","product":"siplus s7-300 cpu 315f-2 pn/dp"},{"vendor":"siemens","product":"siplus s7-300 cpu 317-2 pn/dp"},{"vendor":"siemens","product":"siplus s7-300 cpu 317f-2 pn/dp"},{"vendor":"siemens","product":"siplus s7-400 cpu 414-3 pn/dp v7"},{"vendor":"siemens","product":"siplus s7-400 cpu 416-3 pn/dp v7"},{"vendor":"siemens","product":"siwarex wp231"},{"vendor":"siemens","product":"siwarex wp241"},{"vendor":"siemens","product":"siwarex wp251"},{"vendor":"siemens","product":"siwarex wp521 st"},{"vendor":"siemens","product":"siwarex wp522 st"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-915282.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40820"},{"url":"https://github.com/advisories/GHSA-84r6-pwmm-h2fw"}],"sources":{"cve":[{"id":"CVE-2025-40820","description":"Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.","status":"published","published":"2025-12-09T10:44:30.977Z","modified":"2025-12-09T15:55:23.4Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-940"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-201923","description":"Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.","status":"published","published":"2025-12-09T10:44:30Z","modified":"2025-12-09T15:55:23Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"ghsa":[{"id":"GHSA-84r6-pwmm-h2fw","title":"Affected products do not properly enforce TCP sequence number validation in specific scenarios...","description":"Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.","status":"published","published":"2025-12-09T18:30:36Z","modified":"2025-12-09T18:30:43Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-940"],"updated_at":"2026-11-02T15:05:06.487163Z"}],"nvd":[{"id":"CVE-2025-40820","description":"Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.","status":"published","published":"2025-12-09T16:17:46.413Z","modified":"2026-10-07T11:10:00.153Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-940"],"updated_at":"2026-11-02T14:11:49.093461Z"}]}}