CVE-2025-40941
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-10
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | simatic_cn_4100 | * |
| siemens | simatic_cn_4100_firmware | to 4.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects SIMATIC CN 4100 devices with versions earlier than V4.0.1. The affected devices expose server information in their responses, which could allow an attacker with network access to gather useful information. This information disclosure increases the likelihood of targeted attacks against the device or network.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker with network access to obtain server information from the affected devices. This information can be used to plan and execute targeted attacks, potentially compromising the security of your network or systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the responses from SIMATIC CN 4100 devices for exposed server information. Since the vulnerability involves the device exposing server information in its responses, network scanning or querying the device's REST API endpoints and analyzing the returned data for sensitive server details can help detect it. Specific commands are not provided in the resources, but using tools like curl or wget to send requests to the device's REST API and inspecting the responses for server information exposure is a practical approach.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the SIMATIC CN 4100 device firmware to version V4.0.1 or later, as recommended by Siemens. Additionally, protecting network access to the devices by implementing proper network segmentation and following Siemens' operational guidelines for Industrial Security are advised to reduce the risk of exploitation. [1]