Auth bypass in Siemens Ruggedcom Rst2428p
CVE-2025-40568
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). An internal session termination functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to terminate legitimate users' sessions.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.005 (42.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Siemens Ruggedcom Rst2428p — versions 0
- Siemens Scalance Xch328 — versions 0
- Siemens Scalance Xcm324 — versions 0
- Siemens Scalance Xcm328 — versions 0
- Siemens Scalance Xcm332 — versions 0
- Siemens Scalance Xrh334 (24 V Dc, 8xfo, Cc) — versions 0
- Siemens Scalance Xrm334 (230 V Ac, 12xfo) — versions 0
- Siemens Scalance Xrm334 (230v Ac, 2x10g, 24xsfp, 8xsfp+) — versions 0
- Siemens Scalance Xrm334 (230 V Ac, 8xfo) — versions 0
- Siemens Scalance Xrm334 (24 V Dc, 12xfo) — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-40568?
- CVE-2025-40568 is a medium-severity vulnerability in Siemens Ruggedcom Rst2428p, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2025-06-10.
- How severe is CVE-2025-40568?
- Medium severity. CVSS v3 base score is 4.3 out of 10.