cve-2025-40767

CVE-2025-40767 is part of a cluster of vulnerabilities disclosed in Siemens' SINEC Traffic Analyzer, an on-premises PROFINET monitoring tool used in utilities, manufacturing, and energy networks. The flaws, detailed in vendor advisory SSA-517338 and republished by CISA, affect the product's containerized deployment, web UI, and internal management interfaces. They include null pointer dereference, use-after-free, uncontrolled resource consumption, execution with unnecessary privileges, exposure of sensitive information, unsafe Content Security Policy, and a non-passive monitoring channel. These issues can lead to denial-of-service, privilege escalation, information exposure, and cross-site scripting risks. Siemens ProductCERT has released updates across multiple version lines; users are urged to apply patches to mitigate OT/IT network risks.