CVE-2025-40766 Denial of service in SINEC Traffic Analyzer
An attacker can cause a denial-of-service condition in Siemens SINEC Traffic Analyzer by exploiting inadequate resource limits in Docker containers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40766?
CVE-2025-40766 is a medium-severity denial of service vulnerability in Siemens SINEC Traffic Analyzer, published on 12 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate resource and security limitations. This could allow an attacker to perform a denial-of-service (DoS) attack.
Weakness: CWE-400
Which versions are affected by CVE-2025-40766?
It affects 1 product.
Products include Siemens Sinec Traffic Analyzer.
How do I fix CVE-2025-40766?
No fix has been published for CVE-2025-40766 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40766 being exploited?
There is no known exploitation of CVE-2025-40766 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Siemens SINEC Traffic Analyzer
Sources
Also known as GHSA-g4ph-6vqp-8f75.