# Siemens SiPass Integrated multiple vulnerabilities pre-V3.0

Published: 2025-10-16 · Severity: elevated · Sectors: government-national, defense, infrastructure
Canonical: https://vorant.io/reports/22ea3d88-29c1-5160-b9f4-2fb83ac9629a/siemens-sipass-integrated-multiple-vulnerabilities-pre-v3-0

> Four vulnerabilities in Siemens SiPass integrated versions before V3.0 allow buffer overflow, XSS, authorization bypass, and password recovery; no active exploitation reported.

Siemens SiPass integrated, a physical access control system deployed worldwide, contains four security vulnerabilities in versions prior to V3.0. A heap-based buffer overflow (CVE-2023-35002) in image file handling can trigger arbitrary code execution; a stored XSS flaw (CVE-2025-40772) allows session hijacking and impersonation; a broken access control vulnerability (CVE-2025-40773) permits unauthorized API requests and data manipulation; and weak password storage (CVE-2025-40774) allows administrators with database access to recover plaintext credentials. The buffer overflow requires a malformed file upload and the XSS requires user interaction, but all vulnerabilities require network access to the affected server. CISA reports no known public exploitation as of publication. Siemens recommends immediate upgrade to V3.0 or later, restricting network access, and limiting file uploads to trusted sources.

## Mentioned in this report

- Vulnerabilities: CVE-2023-35002, CVE-2025-40772, CVE-2025-40773, CVE-2025-40774

## Detection guidance (public sample)

### SiPass Integrated Process Spawning Shell or Script Interpreter

ATT&CK: T1190

SiPass Integrated server/service processes spawning cmd, PowerShell, or LOLBins, which may indicate exploitation of the image-handling heap overflow (CVE-2023-35002). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SiPass Integrated Process Spawning Shell or Script Interpreter
description: Detects processes whose parent image path contains SiPass spawning command
  shells, script hosts or common download/execute LOLBins. This may indicate post-exploitation
  code execution after the heap-based buffer overflow in image file handling (CVE-2023-35002)
  in SiPass Integrated before V3.0. The ParentImage match assumes SiPass binaries
  carry 'SiPass' in their install path or name, so validate it against local installs.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-06
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \SiPass
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- SiPass installer, upgrade or maintenance routines that call cmd.exe or PowerShell
  scripts
- Site-specific backup or database maintenance scripts launched by a SiPass service
level: medium
id: fadab9e7-6d76-53c9-803c-712d084e4aee
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/22ea3d88-29c1-5160-b9f4-2fb83ac9629a/siemens-sipass-integrated-multiple-vulnerabilities-pre-v3-0.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup