CVE-2025-40820: siemens sidoor_atd430w_firmware

Vulnerability summary

CVE-2025-40820 is a high (CVSS 8.7) vulnerability in siemens sidoor_atd430w_firmware. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities.

Timeline

1. 09-12-2025
   PublishedVulnerability first disclosed.
2. 09-12-2025
   Last modifiedVulnerability information updated.

Description

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

• CWE-940Improper Verification of Source of a Communication ChannelThe product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.