Vulnerability in Siemens Power Meter Sicam Q100
CVE-2025-40753
A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q200 family (All versions >= V2.70 < V2.80). Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes.
EPSS: 0.001 (0.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Siemens Power Meter Sicam Q100 — versions V2.60
- Siemens Power Meter Sicam Q200 Family — versions V2.70
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-40753?
- CVE-2025-40753 is a medium-severity vulnerability in Siemens Power Meter Sicam Q100, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.2/10. Published 2025-08-12.
- How severe is CVE-2025-40753?
- Medium severity. CVSS v3 base score is 6.2 out of 10.