Often an OT network relies on capable edge devices that sit directly on the factory floor, close to machines and sensors, to process and forward operational data to the outside world. For example, in a manufacturing plant, sensors on production machines continuously measure temperature, pressure, vibration, and operating status. These raw signals are collected by an industrial edge system located at the OT/IT boundary, where the data is aggregated, filtered, and summarized before being forwarded to higher-level systems such as SCADA or central monitoring platforms. The same system may also relay commands or configuration updates back to the machines.
From an attacker's point of view, this type of network element is especially valuable. Because so much traffic and telemetry flow through it, compromising the device could provide broad visibility into sensor and actuator data, and in some situations even enable manipulation of the information or commands being processed or forwarded. An attacker who gains control of such a system might observe production behavior in real time, falsify operational data seen by operators, or interfere with communication between the control room and the machines.
The Siemens SCALANCE LPE9403 is exactly one of these devices. It is a Local Processing Engine (LPE), essentially a rugged industrial PC, designed to run edge workloads such as data aggregation, monitoring, protocol handling, and analytics while interfacing with both industrial networks and higher-level IT systems. Positioned squarely at the OT/IT boundary, it plays a critical role in how operational data is collected, interpreted, and exchanged across the plant.
Security researchers at Nozomi Networks Labs identified 12 vulnerabilities affecting the Siemens SCALANCE LPE9403 and responsibly reported the findings to Siemens, providing the technical details needed to reproduce and assess the issues. In this blog post, we detail how these vulnerabilities could be exploited in real-world attack scenarios and discuss their potential impact on OT environments.
Some of the vulnerabilities affecting the device's DCP (Discovery and Configuration Protocol) service were already covered in a dedicated blog post, so check it out if you want more information on that.
After submitting our findings, Siemens analyzed, fixed, and disclosed the vulnerabilities, publishing an advisory available here. Operators should review the advisory and promptly apply the recommended updates to reduce exposure and protect their industrial environments.
Research Scope
Our research looked at the Siemens SCALANCE LPE9403 Local Processing Engine (LPE), a rugged industrial "edge PC" that's installed in OT environments to run local apps and expose a set of services that help it integrate into plant networks. Depending on how it's deployed, it could be used as a data aggregator: pulling telemetry and operational signals from the OT network, then forwarding that data upstream to SCADA systems (and similar monitoring/control platforms).
Users can also optionally install the SINEMA Remote Connect client on the SCALANCE LPE. SINEMA Remote Connect is Siemens' remote-access solution, used to provide secure VPN-based connectivity so that authorized operators, system integrators, or maintenance teams can reach industrial assets without being physically on site. Since that client becomes part of the SIEMENS LPE software stack and can influence the device's remote exposure, the SINEMA Remote Connect package was also a target of our research.
Vulnerability List and Affected Versions
Nozomi Networks Labs identified the following issue in Siemens SCALANCE LPE9403 devices.
These vulnerabilities are present in devices with firmware version lower than V4.0 HF0:
These vulnerabilities are present in devices with the SINEMA Remote Connect Edge Client installed, until version V2.1:
Potential Impact of the Vulnerabilities
The impact of the identified vulnerabilities is strongly influenced by the role of the Siemens SCALANCE LPE9403 as an OT edge device and by the fact that several issues can be chained to achieve full system compromise. Multiple vulnerabilities allow attackers to move from limited access to root-level control of the SCALANCE LPE, significantly increasing the potential impact on industrial environments.
T0832: Manipulation of View
The vulnerability chain formed by CVE-2025-40572, CVE-2025-40573, and CVE-2025-40574 allows a low-privileged, read-only user on the SCALANCE LPE to escalate privileges and obtain root access on the device. Once an attacker gains full control of the SCALANCE LPE, they can tamper with telemetry and process data handled by the device before it is forwarded to SCADA systems or monitoring platforms. This could be used to alter sensor values, suppress alarms, or falsify process states, giving operators a misleading view of what is happening in the OT environment.
T0882: Theft of Operational Information
With root access obtained through the same privilege-escalation chain (CVE-2025-40572/73/74) or via the SINEMA Remote Connect vulnerabilities (CVE-2025-40581 and CVE-2025-40582), an attacker could access a broad range of sensitive data stored or processed on the SCALANCE LPE. This includes operational telemetry, configuration files, credentials, network mappings, and details about connected OT assets. Such information could be exfiltrated to support industrial espionage or to enable more targeted follow-on attacks.
T0814: Denial of Service
Full system compromise of the SCALANCE LPE also enables attackers to disrupt its availability. After exploiting the privilege-escalation chain or achieving root-level command execution through the SINEMA client vulnerabilities, an attacker could stop critical services, exhaust system resources, or interfere with edge applications. This could result in a loss of visibility at the OT edge, preventing data from reaching SCADA systems and limiting operators' ability to monitor ongoing processes.
Attack Scenarios
As discussed earlier, the Siemens SCALANCE LPE9403 can be deployed as a data aggregation and processing point at the OT edge, collecting telemetry from OT devices, processing it locally, and forwarding it to visualization or monitoring systems such as SCADA platforms. Because of this central role, compromising the SCALANCE LPE can give an attacker both visibility into OT operations and the ability to influence how those operations are presented upstream.
Based on the vulnerabilities identified, we defined two representative attack scenarios. The first focuses on manipulating operational telemetry after gaining limited access and escalating privileges on the device. The second explores how compromising a SINEMA Remote Connect Server could be abused to move laterally and gain control over multiple SCALANCE LPE devices across different OT networks.
Telemetry Manipulation
In this scenario, the SCALANCE LPE is used to collect telemetry from the OT network and forward it to a SCADA or visualization system. The attacker's first step is obtaining read-only, unprivileged credentials for the SCALANCE LPE. In real-world environments, this could happen in several ways: for example, by extracting machine-to-machine credentials stored on another compromised system, recovering credentials from configuration backups, or leveraging weak credential management practices where the same accounts are reused across multiple systems.
With unprivileged access to the SCALANCE LPE, the attacker then exploits the local privilege escalation chain formed by CVE-2025-40572, CVE-2025-40573, and CVE-2025-40574, ultimately gaining root access to the device. At this point, the attacker has full control over the services and applications running on the SCALANCE LPE.
Using this level of access, the attacker can tamper the telemetry data processed by the SCALANCE LPE before it is forwarded to the SCADA system. Sensor readings can be altered, alarms can be suppressed, and process values can be selectively modified. As a result, operators are presented with a falsified view of the process, while the underlying OT environment may be operating in an unsafe or abnormal state. This type of attack is particularly dangerous because it can remain stealthy for long periods and undermine trust in monitoring and visualization systems.
SINEMA Remote Connect Lateral Movement
The second scenario assumes a different initial foothold: the attacker gains control of a SINEMA Remote Connect Server that is trusted by a group of SCALANCE LPE devices. This could happen through the compromise of the server itself, stolen administrative credentials, or exploitation of vulnerabilities in the SINEMA infrastructure.
Once in control of the SINEMA server, the attacker can target the SCALANCE LPE devices connected to it by exploiting the command injection vulnerability in the SINEMA Remote Connect client (CVE-2025-40582). The vulnerability allows command execution as root on the SCALANCE LPE, enabling the attacker to immediately gain full control of each connected device.
From there, the attacker can establish persistence on the compromised SCALANCE LPE systems and use them as entry points into the OT networks they are connected to. Since each SCALANCE LPE may bridge or interface with a different OT segment, this enables lateral movement across multiple industrial networks. At that stage, the attacker can carry out the same impacts described earlier, such as Manipulation of View, Denial of Service, and Theft of Operational Information, but now at a much broader scale, potentially affecting multiple sites or processes at once.
Vulnerability Spotlight: SINEMA Remote Connect Client Exploitation
SINEMA Remote Connect is a Siemens management platform designed for remote industrial networks. It allows edge devices to be securely reached from IT networks by establishing VPN connections that link together geographically distributed systems and sites.
In the case of the SCALANCE LPE9403, the SINEMA Remote Connect client is provided as a standalone software package that ships with the official firmware distribution. Alongside the main system image and other optional components, the firmware bundle includes a dedicated SINEMA client package, as shown below:
The SINEMA Remote Connect Package
To better understand how the SINEMA Remote Connect client is implemented on the SCALANCE LPE, let's analyze the contents of the software package.
The extracted files include:
- a large TAR archive containing the SINEMA client runtime,
- an installation script (SINEMA_RC.sh),
- and metadata used by the firmware update mechanism.
The TAR archive itself contains the following files:
The first file we analyzed was SINEMA_RC.sh, which is executed automatically during package installation.
One of its main tasks is loading a Docker image stored inside the package:
After loading the image, the script modifies the SCALANCE LPE web configuration by appending a custom nginx configuration file:
The appended configuration (endpoint.conf) defines a new reverse-proxied endpoint:
This configuration exposes the /sinema_rc_edge_client/ path on the SCALANCE LPE web interface, enforces admin authentication, and forwards incoming requests to a service listening on http://localhost:9090/.
Finally, the installation script creates and starts a Docker container using the previously loaded image:
Several aspects of this container configuration are particularly relevant from a security perspective:
- the container runs with high privileges, including the SYS_ADMIN capability,
- it shares the host PID namespace,
- it mounts /dev/net/tun, required for VPN functionality,
- and it exposes an internal HTTP service that is later proxied by nginx.
The service inside the container listens on port 8080, which is mapped to 127.0.0.1:9090 on the host and then exposed externally through the nginx reverse proxy.
To summarize, the SINEMA Remote Connect client on the SCALANCE LPE is implemented as follows:
- it is deployed as a Docker container, with the image embedded as a TAR archive inside the installation package,
- the container exposes HTTP APIs that are made accessible through the SCALANCE LPE web interface via a nginx reverse proxy, which also acts as a TLS terminator,
- the container runs with elevated privileges, giving it significant control over the underlying system.
A first vulnerability in this design (tracked as CVE-2025-40581) stems from the fact that, while authentication is enforced at the nginx level, a local user can directly interact with the service on http://127.0.0.1:9090, effectively bypassing the authentication mechanism.
It is important to note that admin users of the SCALANCE LPE are also root users on the device, but the system also supports guest users with unprivileged SSH access. Users in this latter category can therefore directly interact with the SINEMA configuration endpoint despite lacking administrative privileges.
Configuring the SINEMA Client
Let's now look at what an authenticated user can configure through the SINEMA web interface.
As shown in the figure above, an admin can modify:
- The Server Settings (Address and Port) of the SINEMA Remote Connect server
- The Server Verification, i.e., the TLS certificate fingerprint
- The Device Credentials (ID and password) used by the client to authenticate to the server
This information is used by a daemon called siesecman, running inside the Docker container, to contact the SINEMA Remote Connect server and retrieve the VPN configuration needed to connect the SCALANCE LPE to a specific remote network.
Internally, the siesecman daemon uses libcurl to perform an HTTPS GET request to:
https://ServerAddr:ServerPort/DeviceID/
The server is expected to reply with a JSON document containing the configuration parameters, including the OpenVPN settings. In short, an admin of the SCALANCE LPE specifies the SINEMA server details, and the device retrieves an OpenVPN configuration from the server and connects to the VPN.
Exploiting the VPN Configuration
An (simplified) example of the JSON structure expected by the siesecman daemon is shown below:
The most interesting fields are those inside the "ovpn" object. Every key-value pair in this dictionary is directly translated into an OpenVPN configuration directive. This means the server can inject arbitrary OpenVPN options into the client configuration.
The issue arises because some OpenVPN directives can be used to execute arbitrary commands on the client system. One example is the "up" directive, which specifies a command to be executed when the VPN interface is brought up.
An attacker controlling the SINEMA server can therefore return a JSON document like the following:
This results in arbitrary command execution when the daemon tries to connect to the VPN (it is not needed for the VPN connection to succeed in order to trigger the command execution). This issue is tracked as CVE-2025-40582.
Escaping the Docker Container
Although the injected command initially executes inside the container, the container's configuration makes escaping trivial. Because the container is privileged and shares the host PID namespace, an attacker can use nsenter to execute commands directly in the host namespace.
For example, the following command, executed from inside the container, adds a user to the host's sudo group:
This effectively grants root-level access to the host system.
Exploitation Scenarios
The command injection vulnerability can be exploited in two main ways (as also described in the Attack Scenarios section):
- Local Privilege Escalation: an unprivileged SCALANCE LPE user connects via SSH, configures the SINEMA client to point to a server controlled by the attacker (exploiting the authentication bypass), and abuses the command injection to obtain root command execution on the device.
- Malicious SINEMA Server: a compromised or rogue SINEMA Remote Connect server can execute arbitrary root commands on all SCALANCE LPE devices connected to it, enabling large-scale compromise and lateral movement across OT environments.
Remediation
Siemens has addressed these vulnerabilities through security patches for the SCALANCE LPE9403 firmware and published a security report. Asset owners and operators are strongly urged to:
- Update affected Siemens SCALANCE LPE9403 devices with the newer version of the firmware.
- Implement network segmentation to limit exposure of systems.
- Monitor network traffic for the presence of vulnerable assets.
To help organizations promptly identify whether the devices with the vulnerable firmware are present in their environment, asset owners can rely on the advanced capabilities of Nozomi Networks OT/IoT Security Platform. The platform provides deep visibility into network traffic and host activities, enabling effective vulnerability and threat detection across OT networks.
This proactive monitoring empowers security teams to respond to vulnerabilities and attacks swiftly and effectively, minimizing the impact of attacks targeting critical networks. To learn more about Nozomi Networks OT/IoT Security Platform and see it in action, request a demo today.
Taking prompt action is vital to protect critical infrastructure and maintain operational integrity.
