Siemens SINAMICS Drives
Monitor6.3ICS-CERT ICSA-25-254-03Sep 9, 2025
Attack VectorLocal
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
Siemens SINAMICS G220, S210, and S200 drives contain a privilege escalation vulnerability (CWE-269) that allows users with limited permissions to escalate to higher privilege levels through user interaction with a deceptive prompt. This vulnerability requires local access and user action; it is not remotely exploitable and has high attack complexity. Siemens has released fixes for G220 and S210 but has no fix planned for S200.
What this means
What could happen
A user with limited permissions on a SINAMICS drive could escalate their privileges to gain higher access levels, potentially allowing them to modify drive configurations, alter motor speed setpoints, or disable safety interlocks. This requires user interaction and is not remotely exploitable.
Who's at risk
Water authorities and municipal electric utilities operating Siemens SINAMICS variable frequency drives (G220, S200, S210 series) for pump and motor control. This affects any facility using these drives for critical process operations like water distribution, wastewater treatment, or power generation.
How it could be exploited
An attacker with local access to a SINAMICS drive or its engineering interface must interact with a deceptive prompt or dialog to trigger privilege escalation. The attacker would need to be authenticated as a lower-privileged user and trick them into performing an action that elevates their permissions, then use those elevated privileges to modify drive parameters or operations.
Prerequisites
- Local access to the drive or engineering workstation
- Valid user account with limited (non-administrator) privileges
- User interaction required (requires the user to respond to a prompt or dialog)
High attack complexityUser interaction requiredLocal access onlyNo patch available for SINAMICS S200
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
SINAMICS G220 V6.4<V6.4 HF26.4 HF2
SINAMICS S200 V6.4<V6.4 HF76.4 HF7
SINAMICS S210 V6.4<V6.4 HF26.4 HF2
Remediation & Mitigation
0/5
Do now
0/1HARDENINGRestrict network access to SINAMICS drives to authorized engineering workstations only using firewall rules or network segmentation
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
SINAMICS S210 V6.4
HOTFIXSINAMICS S210 V6.4: Update to V6.4 HF2 or later
SINAMICS G220 V6.4
HOTFIXSINAMICS G220 V6.4: Update to V6.4 HF2 or later
SINAMICS S200 V6.4
HARDENINGSINAMICS S200 V6.4: No vendor fix is available. Implement compensating controls.
Long-term hardening
0/1HARDENINGEnsure engineering workstations and drives are isolated from the corporate network
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/58512e3a-da65-4511-8289-b13b07bf9a1b