CVE-2025-40593
BaseFortify
Publication date: 2025-07-08
Last updated on: 2025-12-16
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | simatic_cn_4100_firmware | to 4.0 (inc) |
| siemens | simatic_cn_4100 | to 4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Siemens SIMATIC CN 4100 devices (all versions before V4.0). It allows an attacker with low privileges to cause a denial of service (DoS) by storing arbitrary files in the device's SFTP folder due to improper input validation. The vulnerability impacts the availability of the device but does not affect confidentiality or integrity. [1]
How can this vulnerability impact me? :
The vulnerability can cause a denial of service condition on the affected Siemens SIMATIC CN 4100 device, making the device unavailable for normal operation. This can disrupt communication and control functions relying on the device, potentially impacting industrial processes or network operations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring the SFTP folder on the affected SIMATIC CN 4100 devices for the presence of arbitrary or unexpected files, as the vulnerability is exploited by storing such files there. Network monitoring for unusual SFTP activity or unauthorized file uploads to these devices may also help identify exploitation attempts. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the affected SIMATIC CN 4100 devices to version 4.0 or later, as recommended by Siemens. Additionally, implement general security measures such as protecting network access to these devices and configuring the environment according to Siemens' operational guidelines for Industrial Security to reduce exposure. [1]