In the second part of its research on security vulnerabilities in Siemens SCALANCE LPE9403 Local Processing Engine, researchers from Nozomi Networks Labs identified 12 vulnerabilities that affect devices running firmware below V4.0 HF0. Three additional flaws affect systems with the SINEMA Remote Connect Edge Client installed through version V2.1. Vulnerabilities include privilege escalation, path traversal, authentication bypass, command injection, buffer overflows, and memory-handling issues, with CVSS scores ranging from 5.3 to 8.5.
Nozomi identified that several of the vulnerabilities can be chained to obtain root-level control of the SCALANCE LPE9403, potentially allowing attackers to manipulate telemetry, suppress alarms, access operational information, or disrupt services. In one scenario, an attacker with limited access could exploit three vulnerabilities to escalate privileges and alter data sent to SCADA or visualization systems. In another instance, compromising a SINEMA Remote Connect server could enable command execution on connected SCALANCE LPE devices and facilitate lateral movement across multiple OT networks.
The researchers noted that “the impact of the identified vulnerabilities is strongly influenced by the role of the Siemens SCALANCE LPE9403 as an OT edge device and by the fact that several issues can be chained to achieve full system compromise. Multiple vulnerabilities allow attackers to move from limited access to root-level control of the SCALANCE LPE, significantly increasing the potential impact on industrial environments.”
The San Francisco, California-based vendor reported the findings responsibly to Siemens with technical reproduction details, then documented real-world exploitation scenarios and their OT environment impact. DCP (Discovery and Configuration Protocol) vulnerabilities are detailed in a separate technical analysis. Siemens analyzed and patched vulnerabilities and published an advisory that asset owners and operators must review and apply updates immediately, implement network segmentation, and monitor for vulnerable systems to reduce exposure.
“Our research looked at the Siemens SCALANCE LPE9403 Local Processing Engine (LPE), a rugged industrial ‘edge PC’ that’s installed in OT environments to run local apps and expose a set of services that help it integrate into plant networks,” according to the post. “Depending on how it’s deployed, it could be used as a data aggregator: pulling telemetry and operational signals from the OT network, then forwarding that data upstream to SCADA systems (and similar monitoring/control platforms).”
Users can also optionally install the SINEMA Remote Connect client on the SCALANCE LPE. SINEMA Remote Connect is Siemens’ remote-access solution, used to provide secure VPN-based connectivity so that authorized operators, system integrators, or maintenance teams can reach industrial assets without being physically on site. Since that client becomes part of the SIEMENS LPE software stack and can influence the device’s remote exposure, the SINEMA Remote Connect package was part of Nozomi’s research.
Nozomi Networks Labs identified nine vulnerabilities in Siemens SCALANCE LPE9403 devices running firmware versions lower than V4.0 HF0. The vulnerabilities include incorrect permission assignment for a critical resource, path traversal, use of an uninitialized value, NULL pointer dereference, out-of-bounds read and stack-based buffer overflow issues. The vulnerabilities are tracked as CVE-2025-40572 through CVE-2025-40580 and have CVSS scores ranging from 5.3 to 8.5.
The researchers also identified three vulnerabilities in SCALANCE LPE9403 devices with the SINEMA Remote Connect Edge Client installed through version V2.1. These vulnerabilities include authentication bypass using an alternate path or channel, improper neutralization of special elements used in an OS command, and cleartext transmission of sensitive information. The vulnerabilities are tracked as CVE-2025-40581 through CVE-2025-40583, with CVSS scores ranging from 6.7 to 8.5.
A vulnerability chain comprising CVE-2025-40572, CVE-2025-40573, and CVE-2025-40574 allows low-privileged, read-only users on the SCALANCE LPE to escalate privileges and gain root access. Once attackers control the device, they can manipulate telemetry and process data before forwarding to SCADA systems or monitoring platforms, altering sensor values, suppressing alarms, or falsifying process states to give operators a false view of OT environment conditions.
The same privilege-escalation chain, along with SINEMA Remote Connect vulnerabilities (CVE-2025-40581 and CVE-2025-40582), enables attackers with root access to exfiltrate sensitive data including operational telemetry, configuration files, credentials, network mappings, and details about connected OT assets. This information supports industrial espionage or enables more targeted follow-on attacks against the broader industrial infrastructure.
Full system compromise of the SCALANCE LPE also allows attackers to disrupt availability by stopping critical services, exhausting system resources, or interfering with edge applications after exploiting the privilege-escalation or SINEMA client vulnerabilities. The result is loss of visibility at the OT edge, preventing data from reaching SCADA systems and limiting operators’ ability to monitor ongoing processes.
The Siemens SCALANCE LPE9403 can be deployed as a data aggregation and processing point at the OT edge, collecting telemetry from OT devices, processing it locally, and forwarding it to visualization or monitoring systems such as SCADA platforms.
“Because of this central role, compromising the SCALANCE LPE can give an attacker both visibility into OT operations and the ability to influence how those operations are presented upstream,” the post added. “Based on the vulnerabilities identified, we defined two representative attack scenarios. The first focuses on manipulating operational telemetry after gaining limited access and escalating privileges on the device. The second explores how compromising a SINEMA Remote Connect Server could be abused to move laterally and gain control over multiple SCALANCE LPE devices across different OT networks.”
When it came to telemetry manipulation, the researchers said that in this scenario, the SCALANCE LPE is used to collect telemetry from the OT network and forward it to a SCADA or visualization system. The attacker’s first step is obtaining read-only, unprivileged credentials for the SCALANCE LPE. In real-world environments, this could happen in several ways: for example, by extracting machine-to-machine credentials stored on another compromised system, recovering credentials from configuration backups, or leveraging weak credential management practices where the same accounts are reused across multiple systems.
“With unprivileged access to the SCALANCE LPE, the attacker then exploits the local privilege escalation chain formed by CVE-2025-40572, CVE-2025-40573, and CVE-2025-40574, ultimately gaining root access to the device,” the post added. “At this point, the attacker has full control over the services and applications running on the SCALANCE LPE.”
Using this level of access, the attacker can tamper with the telemetry data processed by the SCALANCE LPE before it is forwarded to the SCADA system. Sensor readings can be altered, alarms can be suppressed, and process values can be selectively modified. As a result, operators are presented with a falsified view of the process, while the underlying OT environment may be operating in an unsafe or abnormal state. This type of attack is particularly dangerous because it can remain stealthy for long periods and undermine trust in monitoring and visualization systems.
In the second scenario, the researchers said they assume a different initial foothold: the attacker gains control of a SINEMA Remote Connect Server that is trusted by a group of SCALANCE LPE devices. This could happen through the compromise of the server itself, stolen administrative credentials, or exploitation of vulnerabilities in the SINEMA infrastructure.
“Once in control of the SINEMA server, the attacker can target the SCALANCE LPE devices connected to it by exploiting the command injection vulnerability in the SINEMA Remote Connect client (CVE-2025-40582),” they mentioned. “The vulnerability allows command execution as root on the SCALANCE LPE, enabling the attacker to immediately gain full control of each connected device.”
From there, Nozomi identified that the attacker can establish persistence on the compromised SCALANCE LPE systems and use them as entry points into the OT networks they are connected to. Since each SCALANCE LPE may bridge or interface with a different OT segment, this enables lateral movement across multiple industrial networks. At that stage, the attacker can carry out the same impacts described earlier, such as manipulation of view, denial of service, and theft of operational information, but now at a much broader scale, potentially affecting multiple sites or processes at once.
The command injection vulnerability can be exploited in two main ways. An unprivileged SCALANCE LPE user can connect via SSH, configure the SINEMA client to point to an attacker-controlled server by exploiting the authentication bypass, and abuse the command injection to obtain root command execution on the device. Alternatively, a compromised or rogue SINEMA Remote Connect server can execute arbitrary root commands on all SCALANCE LPE devices connected to it, enabling large-scale compromise and lateral movement across OT environments.
Siemens has addressed these vulnerabilities through security patches for the SCALANCE LPE9403 firmware and published a security report. Asset owners and operators must update affected Siemens SCALANCE LPE9403 devices with the newer version of the firmware; implement network segmentation to limit system exposure and monitor network traffic for the presence of vulnerable assets.
Last week, Nozomi researchers identified four memory-corruption vulnerabilities in the PROFINET Discovery and basic Configuration Protocol (DCP) implementation running on the Siemens SCALANCE LPE9403 industrial PC, using an emulation-driven fuzzing technique combining process snapshots, the Unicorn CPU emulator and AFL++. These security vulnerabilities affect SCALANCE LPE9403 firmware up to version V4.0 HF0 and are tracked as CVE-2025-40575 through CVE-2025-40578, with each assigned a CVSS 4.0 score of 5.3. The flaws comprise an uninitialized-value vulnerability, a NULL pointer dereference and two out-of-bounds read vulnerabilities.
