CVE-2025-40820 Denial of service in SIDOOR ATD430W
Unauthenticated remote attackers can cause denial of service in Siemens industrial devices by exploiting weak TCP sequence number validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40820?
CVE-2025-40820 is a high-severity denial of service vulnerability in Siemens SIDOOR ATD430W, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
Weakness: CWE-940
Which versions are affected by CVE-2025-40820?
How do I fix CVE-2025-40820?
No fix has been published for CVE-2025-40820 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40820 being exploited?
There is no known exploitation of CVE-2025-40820 in the wild and no public exploit code.
Sources
Also known as GHSA-84r6-pwmm-h2fw.