CVE-2025-40804
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-09
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | sivaas | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects all versions of Siemens' SIMATIC Virtualization as a Service (SIVaaS). It involves the exposure of a network share without any authentication, which means an attacker can access or modify sensitive data without proper authorization. It is classified as an incorrect permission assignment for a critical resource. [1]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could gain unauthorized access to sensitive data or alter it, potentially compromising the confidentiality and integrity of your information. This could lead to data breaches, operational disruptions, or manipulation of industrial automation systems. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an exposed network share without authentication. Detection can be performed by scanning your network for open SMB or network shares that do not require authentication. Commands such as 'smbclient -L <target_ip>' on Linux or 'net view \\<target_ip>' on Windows can be used to list available shares. Additionally, network scanning tools like Nmap with scripts to detect SMB shares can help identify exposed shares. However, no specific commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting network access to the affected SIMATIC Virtualization as a Service (SIVaaS) system by implementing appropriate network protection mechanisms such as firewalls and access controls. It is recommended to configure the environment according to Siemens' operational guidelines for Industrial Security and to contact Siemens technical support for remediation. Ensuring that network shares are not exposed without authentication is critical to prevent unauthorized access. [1]