CVE-2025-40795
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-10-14
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | simatic_pcs_neo | 4.1 |
| siemens | simatic_pcs_neo | 5.0 |
| siemens | user_management_component | to 2.15.1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack-based buffer overflow in the User Management Component (UMC) integrated into SIMATIC PCS neo V4.1, V5.0, and UMC versions prior to 2.15.1.3. It allows an unauthenticated remote attacker to execute arbitrary code or cause a denial of service by exploiting the overflow in the software's memory handling.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could remotely execute arbitrary code on affected systems without authentication, potentially taking full control of the system. Alternatively, the attacker could cause a denial of service, disrupting operations and availability of the affected products.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for the presence of affected versions of SIMATIC PCS neo V4.1, V5.0, or User Management Component (UMC) versions prior to V2.15.1.3. Additionally, network scanning for open TCP ports 4002 and 4004 on machines with UMC installed can help identify vulnerable systems. For example, using commands like 'netstat -an | grep 4002' or 'netstat -an | grep 4004' on the host, or 'nmap -p 4002,4004 <target-ip>' from a network scanner can detect if these ports are open and potentially exposed. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the UMC update to version 2.15.1.3 or later, which addresses the vulnerability. If updating is not possible, Siemens recommends blocking TCP ports 4002 and 4004 on machines with UMC installed, especially in non-networked deployments. Port 4004 can be blocked universally if the 'RT Server' UMC machine type is not used, without impacting other UMC machine types. Additionally, follow Siemens' general security recommendations such as protecting network access with appropriate mechanisms and configuring environments according to Siemens' operational guidelines for Industrial Security. [1]