Siemens SiPass Integrated multiple vulnerabilities pre-V3.0
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four vulnerabilities in Siemens SiPass integrated versions before V3.0 allow buffer overflow, XSS, authorization bypass, and password recovery; no active exploitation reported.
Siemens SiPass integrated, a physical access control system deployed worldwide, contains four security vulnerabilities in versions prior to V3.0. A heap-based buffer overflow (CVE-2023-35002) in image file handling can trigger arbitrary code execution; a stored XSS flaw (CVE-2025-40772) allows session hijacking and impersonation; a broken access control vulnerability (CVE-2025-40773) permits unauthorized API requests and data manipulation; and weak password storage (CVE-2025-40774) allows administrators with database access to recover plaintext credentials. The buffer overflow requires a malformed file upload and the XSS requires user interaction, but all vulnerabilities require network access to the affected server. CISA reports no known public exploitation as of publication. Siemens recommends immediate upgrade to V3.0 or later, restricting network access, and limiting file uploads to trusted sources.
Mentioned in this report
Detection guidance
SiPass Integrated Process Spawning Shell or Script Interpreter
SiPass Integrated server/service processes spawning cmd, PowerShell, or LOLBins, which may indicate exploitation of the image-handling heap overflow (CVE-2023-35002). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SiPass Integrated Process Spawning Shell or Script Interpreter
description: Detects processes whose parent image path contains SiPass spawning command
shells, script hosts or common download/execute LOLBins. This may indicate post-exploitation
code execution after the heap-based buffer overflow in image file handling (CVE-2023-35002)
in SiPass Integrated before V3.0. The ParentImage match assumes SiPass binaries
carry 'SiPass' in their install path or name, so validate it against local installs.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-06
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \SiPass
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- SiPass installer, upgrade or maintenance routines that call cmd.exe or PowerShell
scripts
- Site-specific backup or database maintenance scripts launched by a SiPass service
level: medium
id: fadab9e7-6d76-53c9-803c-712d084e4aee
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs