Siemens SiPass Integrated
Plan PatchCVSS 8.8ICS-CERT ICSA-25-289-06Oct 14, 2025
Siemens
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
SiPass integrated contains multiple vulnerabilities (CWE-119, CWE-79, CWE-639, CWE-257) that allow an unauthenticated remote attacker to exploit user accounts, manipulate data, impersonate users, or execute arbitrary code on the SiPass integrated server. The vulnerabilities are not remotely exploitable over the Internet but can be exploited by attackers with network access to the server. Affected versions include SiPass integrated V2.95 before 2.95.3.23 and V3.0 pre-release.
What this means
What could happen
An unauthenticated attacker with network access to SiPass integrated could execute arbitrary code on the server, steal user account credentials, or modify system data and access controls. This could allow an attacker to compromise physical security decisions, audit trails, and access management for the protected facility.
Who's at risk
Security and access control teams operating Siemens SiPass integrated physical security systems. The vulnerability affects both V2.95 (before 2.95.3.23) and V3.0 pre-release versions, which manage building access credentials, user accounts, and audit logs for facilities including data centers, manufacturing plants, and critical infrastructure sites.
How it could be exploited
An attacker on the network segment where SiPass integrated is deployed could upload a malicious image file or exploit one of the multiple vulnerabilities (code execution, data manipulation, or authentication bypass) to gain control of the server without needing valid credentials.
Prerequisites
- Network access to SiPass integrated server (no remote internet access required)
- Ability to upload files to the affected application or interact with vulnerable API endpoints
No authentication requiredLow complexity attackAffects security system controlsHigh CVSS score (8.8)Multiple vulnerability types (code execution, authentication bypass, data manipulation)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
SiPass integrated V2.95< 2.95.3.232.95.3.23
SiPass integrated< 3.03.0
Remediation & Mitigation
0/5
Do now
0/3SiPass integrated
WORKAROUNDRestrict network access to SiPass integrated to authorized personnel and trusted administrative workstations only
HARDENINGDo not upload image files from untrusted sources into SiPass integrated until patched to version 3.0 or later
All products
WORKAROUNDDisable or restrict user file upload functionality until the system is patched
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
SiPass integrated
HOTFIXUpdate SiPass integrated to version 3.0 or later
Long-term hardening
0/1SiPass integrated
HARDENINGSegment SiPass integrated network from business networks and the Internet; limit remote access via VPN with multi-factor authentication
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a7c1a247-cb77-4ce6-8b5e-4eae9a70d29bGet OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.