Urgent Siemens Energy Alert: Critical Flaw (CVSS 9.9) in Private 5G Core Exposes Sensitive Data!

Siemens has issued a critical security advisory regarding its Energy Services platform—formerly known as Managed Applications and Services—warning of a severe vulnerability involving default credentials in systems leveraging the Elspec G5 Digital Fault Recorder (G5DFR). The flaw, tracked as CVE-2025-40585, carries a CVSS v3.1 base score of 9.9, highlighting its potential to compromise critical infrastructure.

According to Siemens, “Solutions using Elspec G5 Digital Fault Recorder contain default credentials with admin privileges. A client configuration with remote access could allow an attacker to gain remote control of the G5DFR component and tamper outputs from the device.”

The core issue stems from the presence of hardcoded default usernames and passwords in affected systems. If left unchanged, these credentials may be exploited by unauthenticated remote attackers to seize control of the G5DFR component, enabling manipulation of outputs such as fault monitoring data or triggering false readings in the power grid.

“Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device,” the advisory warns.

The vulnerability has been classified under CWE-276: Incorrect Default Permissions, a common but highly impactful weakness when found in industrial control systems (ICS) and operational technology (OT) devices.

The affected products include:

• Siemens Energy Services with Elspec G5DFR
• All versions currently deployed

No software patch is available at the time of the advisory. Instead, Siemens provides a direct mitigation route:

“Use the G5DFR web interface to change the default usernames, passwords, and permission levels. Contact customer support for further assistance.”

In addition to credential changes, Siemens urges all operators—particularly Transmission System Operators (TSOs) and Distribution System Operators (DSOs)—to adopt resilient, multi-layered protection strategies. This includes validating grid design against cyber-induced faults and securing the network perimeter.

Siemens also emphasizes the importance of securing the broader OT environment:

“Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN)… and to configure the environment according to our operational guidelines.”

Related Posts:

• Hacking Tesla’s MCU-Z: A Breakdown of New AMD-Based Vulnerabilities
• Siemens Fixes 66 SQL Injection Flaws in TeleControl Server Basic
• VMware Sues Siemens: Unlicensed Software Use Alleged
• Cyberattacks Surge Against Energy Sector Amid Geopolitical Tensions
• Kaspersky Report: Energy Industry becomes the largest area affected by vulnerabilities in industrial automation systems