CVE-2025-40570: USB DoS in Siemens SIPROTEC 5 relays - patch and mitigate

Siemens’ SIPROTEC 5 family has resurfaced in industry advisories after researchers and the vendor disclosed a vulnerability that allows attackers with physical access to exhaust a device’s memory via its local USB port, causing temporary loss of network responsiveness; the issue is tracked as CVE-2025-40570 and affects a wide list of SIPROTEC 5 models until the vendor-supplied fixes are applied.

Background​

SIPROTEC 5 relays are distributed digital protection devices used across transmission and distribution systems and in critical manufacturing. The family includes dozens of model variants and communication-processor (CP) variants (CP050, CP100, CP150, CP200, CP300), and they are commonly deployed in substations where availability and deterministic behavior are paramount. The vendor, Siemens, has long published product security advisories—ProductCERT advisories—that document vulnerabilities, affected firmware versions, and available fixes. CISA has also published ICS advisories that summarize vendor findings for U.S. operators but now directs readers to Siemens’ ProductCERT for ongoing updates.
This latest advisory centers on an Allocation of Resources Without Limits or Throttling weakness (CWE‑770) in the SIPROTEC 5 line. The practical effect is a denial‑of‑service style outcome when the device’s local USB network interface receives a high‑bandwidth, specially crafted stream: the device can exhaust volatile resources, stop responding on the USB network interface, and subsequently reset itself. According to the public advisories, the device’s protection functions continue to operate; the risk, therefore, is that the communications plane is temporarily interrupted rather than a direct loss of protective function.

---

Executive summary of the technical facts​

• Vulnerability ID: CVE‑2025‑40570.
• Class: Allocation of resources without limits or throttling (CWE‑770).
• Attack vector: Requires physical access to the device’s local USB port to deliver high‑bandwidth, specially crafted packets. Not remotely exploitable per published advisories.
• Impact: Exhaustion of memory and loss of responsiveness on the USB network interface; affected devices automatically reset. Protection function reported as unaffected in vendor advisory text.
• CVSS: Vendors and aggregators have calculated a low base score (2.4) under CVSS v4 and a matching 2.4 under CVSS v3.1 for this particular issue, reflecting the need for physical access and the limited confidentiality/integrity impact.
• Availability of fixes: Siemens lists fixed releases (V10.0 or later) for many affected models; exact remediation availability varies by CPU family and model. Operators should consult ProductCERT advisories for per‑model guidance.

---

Affected product landscape — what operators need to inventory now​

Siemens’ advisory enumerates dozens of SIPROTEC 5 product types and CPU families that are in scope. The expansive list covers many commonly deployed relay models (for example: 6MD84/85/86/89, 7SA/7SD/7SJ/7SK/7SL/7SS/7ST/7SX/7UT families and the Compact 7SX800 CP050 model), with model‑ and firmware‑specific version windows where exposure exists. In brief:

• Many CP300 variants are affected in firmware versions before V10.0 or in specific ranges (V7.80 up to but not including V10.0) depending on the model.
• CP150 and CP050 variants are also named as affected where firmware is prior to V10.0.

Operators must treat the published lists as definitive for inventorying affected assets and mapping them to installed firmware levels. Vendors often publish per‑model download pages and firmware matrices; matching the installed firmware string to the ProductCERT table is the only reliable way to determine whether a particular installed relay is vulnerable. Siemens’ ProductCERT pages and CISA’s ICS advisories both directive users to consult ProductCERT for model‑level status.

---

Why this matters operationally​

1. Physical access attacks are low frequency but high consequence in OT: While this vulnerability is not remotely exploitable, it presents a realistic attack path in many operational environments. Attackers or insiders who can reach the USB port (engineering workstations, service panels, technicians’ laptops left connected, insecure remote access crates) can cause communications disruption. Given the distributed nature of substations, physical access vectors are non‑trivial.
2. Communications plane interruption can complicate incident response: A device that resets its communications interface may momentarily stop reporting status and alarms, which can obscure real events or create a window where operators miss concurrent faults or misinterpret system health. Even if the core protection functions remain available, the operational monitoring and event‑reporting reliability is degraded.
3. Patch management constraints in ICS environments: Updating relay firmware in production substations involves careful change control, interoperability testing (DIGSI/DIGSI‑5 toolchain), and sometimes scheduled outages. The vendor’s fix (V10.0 or newer for many models) may be appropriate, but rollout timelines vary and require coordination between protection engineers, asset owners, and Siemens support channels. Siemens ProductCERT explicitly details patch versions per model and recommends staged application using vendor tooling.

---

What Siemens and CISA recommend (practical steps)​

Both Siemens (ProductCERT advisories) and CISA’s ICS advisory guidance converge on standard, pragmatic controls for this class of issues. The immediate measures are:

• Apply vendor fixes where available. Siemens lists V10.0 or later for many affected models as the remediation target; implement the update procedure and tooling described by Siemens ProductCERT for each model. Firmware upgrades usually require maintenance windows and may trigger device restarts.
• Restrict physical access to devices. Because the attack requires physical access to the USB port, limiting who can reach relay enclosures, locking control cabinets, and enforcing visitor/contractor controls materially reduces exposure. This is a repeatable, high‑value mitigation.
• Network and interface hardening. Where applicable, disable unused interfaces, limit management access to trusted hosts and management VLANs, and ensure remote access channels to field devices are mediated by hardened jump hosts or gateways. Siemens and CISA both advise defense‑in‑depth segmentation of OT networks and isolation from business networks.
• Operational guidelines & testing. Follow Siemens’ operational guidance for industrial security and product manuals when applying patches and re‑validating protections; perform impact analysis before defensive measures are rolled out. CISA explicitly reminds operators to perform risk assessment and impact analysis.
• Monitor vendor channels. CISA no longer maintains ongoing updates for Siemens advisories beyond initial publication and directs asset owners to Siemens ProductCERT for the authoritative, continuously updated status—operators should subscribe to ProductCERT feeds for near‑real‑time advisories.

---

Step‑by‑step remediation checklist for protection/OT teams​

1. Inventory all SIPROTEC 5 devices and record CPU variant and installed firmware version.
2. Match each device against the Siemens ProductCERT affected‑versions table to flag vulnerable units.
3. For devices with published V10.0 or later fixes: schedule firmware updates according to your maintenance windows and Siemens guidance; test updates in a staging environment where possible.
4. For devices without an immediate fix: implement compensating controls — restrict physical access, disable unused interfaces, isolate the device on an OT management VLAN, and limit connections to trusted IPs.
5. Update incident response and operational procedures to include steps for detecting unexplained USB‑interface resets and verifying protection function continuity.

---

Critical analysis — strengths, gaps, and residual risk​

Strengths in the vendor and community response​

• Transparent, coordinated disclosure: Siemens published ProductCERT advisories, and CISA republished and summarized the findings for a U.S. audience—this coordination accelerates operator awareness. ProductCERT advisories include per‑model details and fixed version numbers where available, which is the right level of operational specificity.
• Low exploitability profile reduces mass‑scale risk: The requirement for physical access significantly lowers the probability of widespread automated exploitation compared with network‑exposed vulnerabilities. The CVSS scores reflect that nuance.

Weaknesses and operational risks​

• Patch availability and logistics: Not all CPU families and models have the same fix timelines; some are listed as “no fix planned” or “currently no fix available” depending on hardware family and model. That forces operators to rely on compensating controls for an indeterminate period for certain units. This complicates risk prioritization across large fleets.
• Reliance on physical‑security posture: Because the vulnerability is mitigated primarily by physical access control, organizations with weaker physical controls or complex supplier/contractor presence at substations remain more exposed. Physical security is often an afterthought in OT risk budgets despite being a primary control for this vulnerability class.
• CISA advisory maintenance change increases burden: The policy change (CISA ceased ongoing updates for Siemens product vulnerabilities on January 10, 2023) places greater responsibility on asset owners to monitor vendor feeds. Organizations without dedicated OT security capability may experience situational awareness gaps.

Residual risk scenarios to plan for​

• An insider or contractor with legitimate physical access could trigger repeated USB‑based exhaustion events to deny monitoring or create noise during concurrent incidents.
• In complex integrated grids, short‑term communications loss—even if protection logic remains intact—may complicate coordinated load shedding or restoration efforts.

Where possible, operators should simulate device resets in test environments to confirm the real‑world impact on supervisory systems and automated workflows.

---

Practical advice for Windows‑facing IT teams who interface with OT​

1. Coordinate asset inventories: Share Windows‑based asset management and CMDB feeds with OT teams so SIPROTEC devices are visible in enterprise inventories and patch programs. Cross‑domain CMDBs reduce blind spots.
2. Harden engineering workstations: Engineers’ laptops are frequently the bridging point between corporate networks and field devices. Enforce least privilege, up‑to‑date endpoint protection, and removable‑media policies on those systems.
3. Control jump hosts and management paths: Windows jump servers used to access DIGSI or other vendor tools should be tightly segmented, logged, and monitored for anomalous file transfers or USB tethering activity.
4. Validate backup and restore procedures: Confirm that firmware update rollbacks and device configuration restores work reliably in staging before mass patching.
5. Include OT‑specific checks in SOC playbooks: Add detection signatures and playbook steps for unexplained USB interface resets, device reboots, or abnormal device‑to‑host traffic patterns to bridge IT/SOC visibility gaps.

---

Verification and cross‑checks performed​

Key technical claims were verified against both Siemens’ ProductCERT advisories and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) ICS advisories to ensure accuracy. Siemens ProductCERT pages list affected models and fixed firmware releases; CISA’s ICS advisories summarize vendor findings and emphasize operational recommendations and the change in advisory maintenance responsibility. Where an independent aggregator provided additional confirmation (CVE aggregator pages and vulnerability feeds), those records corroborated model lists, CVE assignment (CVE‑2025‑40570), and CVSS scoring.
Note: not every per‑model nuance can be exhaustively repeated in a single article; operators must reference Siemens ProductCERT advisories for the canonical, up‑to‑date per‑model and per‑firmware guidance. The vendor’s ProductCERT is the authoritative source for fixed firmware packages and update instructions.

---

Risks that could not be fully verified (flagged for operators)​

• Exploit code availability: At the time of the vendor and CISA advisory publications there were no public reports of active exploitation for CVE‑2025‑40570; however, absence of public exploit code does not rule out private exploitation by sophisticated actors. Operators should assume motivated attackers may develop tooling if exposure exists.
• Model‑specific behavior during resets: Siemens states affected devices “reset themselves automatically” after exhaustion events; operator experience with the exact timing, event logging behavior, and post‑reset state may vary by firmware revision and hardware variant. Teams should test representative devices in a controlled lab to confirm actual behavior.

These flagged items are not contradictions of vendor claims but operational unknowns that require local validation.

---

Long‑term hardening guidance for utilities and ICS operators​

• Adopt a "secure by design" posture for field‑device interfaces: avoid exposed management interfaces; require mutual authentication for local interfaces; and prefer secure management paths that are not dependent on removable ports.
• Institutionalize rapid‑response patch processes for OT: build maintenance windows and test harnesses that allow critical firmware updates to be validated and deployed in weeks, not months.
• Invest in OT‑tailored monitoring: enable packet‑level telemetry and jump‑host logging that can detect abnormal high‑bandwidth USB‑tethered traffic patterns or repeated device resets.
• Expand physical security programs: for devices where physical‑access attacks are meaningful, employ tamper sensors, cabinets with access logs, and stricter contractor supervision.
• Maintain coordinated IT/OT change control: require joint sign‑off between OT engineers, protective relaying teams, and enterprise security prior to firmware changes to minimize service disruptions.

---

Conclusion​

CVE‑2025‑40570 is a clear reminder that classic engineering access points—like USB ports—remain a plausible and practical attack vector for industrial devices. While the vulnerability’s requirement for physical access and the low CVSS score temper its categorization as a systemic crisis, the operational realities in the field (complex fleets, long patch cycles, diverse ownership models) make it a meaningful risk that requires action. The recommended course for operators is unambiguous: inventory SIPROTEC 5 devices now, match firmware against Siemens ProductCERT tables, apply V10.0 or later where available following Siemens update procedures, and for devices awaiting fixes apply compensating controls focused on physical security, interface hardening, and network segmentation. These steps, combined with cross‑domain coordination between Windows IT teams and OT engineers, reduce the likelihood that an actor with physical access can degrade monitoring and communications in critical assets.

---

---

Source: CISA Siemens SIPROTEC 5 | CISA