CVE-2025-40569

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). The "Load Configuration from Local PC" functionality in the web interface of affected products contains a race condition vulnerability. This could allow an authenticated remote attacker to make the affected product load an attacker controlled configuration instead of the legitimate one. Successful exploitation requires that a legitimate administrator invokes the functionality and the attacker wins the race condition.

• CWE-362

• https://cert-portal.siemens.com/productcert/html/ssa-693776.html

Published

Jun 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40555A vulnerability has been identified in APOGEE PXC+TALON TC S…5.3
• CVE-2025-40556A vulnerability has been identified in BACnet ATEC 550-440 (…7.1
• CVE-2025-4056A flaw was found in GLib. A denial of service on Windows pla…7.5
• CVE-2025-40566A vulnerability has been identified in SIMATIC PCS neo V4.1 …9.8
• CVE-2025-40567A vulnerability has been identified in RUGGEDCOM RST2428P (6…7.1
• CVE-2025-40568A vulnerability has been identified in RUGGEDCOM RST2428P (6…5.3
• CVE-2025-4057A flaw was found in ActiveMQ Artemis. The password generated…5.5
• CVE-2025-40570A vulnerability has been identified in SIPROTEC 5 6MD84 (CP3…2.4
• CVE-2025-40571A vulnerability has been identified in Mendix OIDC SSO (Mend…2.2
• CVE-2025-40572A vulnerability has been identified in SCALANCE LPE9403 (6GK…6.8
• CVE-2025-40573A vulnerability has been identified in SCALANCE LPE9403 (6GK…6.7
• CVE-2025-40574A vulnerability has been identified in SCALANCE LPE9403 (6GK…8.5