CVE-2025-40938
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-10
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | simatic_cn_4100 | * |
| siemens | simatic_cn_4100_firmware | to 4.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the SIMATIC CN 4100 device (all versions before V4.0.1) where sensitive information is stored in the firmware. An attacker could exploit this to access and misuse that sensitive information, potentially compromising the device's confidentiality, integrity, and availability.
How can this vulnerability impact me? :
The vulnerability could allow an attacker to access sensitive information stored in the device's firmware, which may lead to misuse of that information. This can impact the confidentiality, integrity, and availability of the device, potentially disrupting its normal operation and exposing sensitive data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the SIMATIC CN 4100 device to version V4.0.1 or later. Additionally, protect network access to the devices and follow Siemens' operational guidelines for Industrial Security. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in SIMATIC CN 4100 allows unauthorized access to sensitive information stored in the firmware, potentially compromising confidentiality, integrity, and availability of data. This could negatively impact compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and maintaining data integrity and availability. However, specific compliance impacts or guidance are not detailed in the provided resources.