CVE-2025-40556
Description
A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All versions), BACnet ATEC 550-446 (All versions). Affected devices improperly handle specific incoming BACnet MSTP messages. This could allow an attacker residing in the same BACnet network to send a specially crafted MSTP message that results in a denial of service condition of the targeted device. A power cycle is required to restore the device's normal operation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A denial-of-service vulnerability in Siemens BACnet ATEC devices allows an attacker on the same BACnet MSTP network to crash a device with a crafted message, requiring a power cycle to recover.
Vulnerability
Details
The vulnerability, tracked as CVE-2025-40556, affects multiple Siemens BACnet ATEC device models (550-440, 550-441, 550-445, 550-446). The root cause is improper handling of specific incoming BACnet MSTP messages. An attacker can exploit this by sending a specially crafted MSTP message to these devices [1].
Exploitation
Requirements
Exploitation requires the attacker to be on the same BACnet network as the target. No authentication or user interaction is needed. The attacker sends a crafted MSTP message via the BACnet MS/TP protocol to the vulnerable device [1].
Impact
Successful exploitation causes the targeted device to enter a denial-of-service (DoS) condition, making it unavailable for normal operation. The device cannot recover automatically; a manual power cycle is required to restore functionality [1].
Mitigation
As of the publication date (May 13, 2025), Siemens has not released a firmware fix for this vulnerability. The vendor recommends following general security best practices, such as protecting network access to affected products with appropriate mechanisms, and running devices in a protected IT environment. No workaround has been provided [1].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.