# Siemens SINAMICS privilege escalation via factory reset

Published: 2025-09-11 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/ac340870-84a9-5616-8a02-487910bd7fc0/siemens-sinamics-privilege-escalation-via-factory-reset

> Improper privilege management in SINAMICS G220, S200, S210 allows local privilege escalation via factory reset manipulation.

Siemens SINAMICS industrial drives contain an improper privilege management vulnerability (CVE-2025-40594) that permits unauthorized privilege escalation. The affected devices allow factory reset operations to be executed without proper authentication checks, and leaked privileges from previous sessions can be manipulated to escalate access. Attack requires local network access and user interaction; no remote exploitation path exists. The vulnerability affects SINAMICS G220 V6.4 (prior to HF2), SINAMICS S210 V6.4 (prior to HF2), and all versions of SINAMICS S200 V6.4. No public exploitation has been reported. Siemens has released hotfixes for G220 and S210 but no fix is currently available for S200. Organizations should isolate these devices from business networks and restrict administrative access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40594

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ac340870-84a9-5616-8a02-487910bd7fc0/siemens-sinamics-privilege-escalation-via-factory-reset.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup