CVE-2025-40772 HIGH

CVE-2025-40772

Vendor Siemens
Product SiPass integrated
Weakness CWE-79 · XSS
Published October 14, 2025
Last update February 10, 2026

CVSS base score

7.4/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation allows an attacker to impersonate other users within the application and steal their session data. This could enable unauthorized access to accounts and potentially lead to privilege escalation.

Key dates

02Disclosure timeline

October 14, 2025 CVE published
February 10, 2026 Record updated