Twelve Vulnerabilities in the Siemens Edge PC That Feeds SCADA

Nozomi Networks Labs has published the technical write-up behind twelve vulnerabilities in the Siemens SCALANCE LPE9403, a rugged edge PC that Nozomi describes as a box installed in OT environments to run local apps and expose a set of services. In practice it aggregates telemetry from the plant network and forwards processed data up to SCADA.

The twelve are numbered CVE-2025-40572 through CVE-2025-40583. The two highest both score 8.5 — an OS command injection (CVE-2025-40582) and an incorrect permission assignment (CVE-2025-40574). Close behind at 8.4 is an authentication bypass, CVE-2025-40581, and the combination is the part worth attention: reach the device unauthenticated, then run commands on it.

Below that the set covers path traversal at 6.7, cleartext transmission at 6.7, another permission issue at 6.8, two stack-based buffer overflows at 5.4, and four memory-safety problems at 5.3 each — an uninitialised value, a NULL pointer dereference and two out-of-bounds reads.

Affected versions are LPE9403 firmware below V4.0 HF0, plus the SINEMA Remote Connect Edge Client up to and including V2.1. Siemens tracks the set as SSA-327438 and has fixed it in V4.0 HF0 and later.

There is a broader point in the count. This is the class of device plants buy precisely so they can run analytics beside the line without touching the PLC, and it typically inherits the patch cadence of a network switch rather than of a server. Twelve findings in one unit, with an unauthenticated path to command execution among them, is a reasonable prompt to check what firmware the edge boxes are actually running — and whether anyone owns that question.