CVE-2025-40795

published 2025-09-09

CVE-2025-40795: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
siemens	simatic_pcs_neo	—	—
siemens	simatic_pcs_neo	—	—
siemens	simatic_pcs_neo_v4.1	< *	*
siemens	simatic_pcs_neo_v5.0	< *	*
siemens	simatic_pcs_neo_v6.0	< V6.0 SP1 Update 1	V6.0 SP1 Update 1
siemens	user_management_component	< V2.15.1.3	V2.15.1.3
siemens	user_management_component	< 2.15.1.3	2.15.1.3

Detection & IOCs extracted from sources · hover to see the quote

process um.Ris.exe↗

port TCP/4002↗

port TCP/4004↗

• → Monitor for crafted network messages targeting um.Ris.exe on TCP ports 4002 and 4004; unauthenticated remote exploitation of Message 17 triggers a stack-based buffer overflow in the UMC process. ↗
• → Alert on unexpected crashes or restarts of um.Ris.exe, which may indicate exploitation attempts via malformed/partial messages or oversized integer values sent to the UMC service. ↗
• → Block or alert on inbound TCP connections to ports 4002 and 4004 from untrusted/external networks on hosts running UMC; these are the attack-surface ports for all four CVEs in this advisory. ↗

• · Port 4004 can be blocked on all non-RT-Server UMC machine types (Server, Ring-Server, Agent) without impacting network functionality; only RT Server deployments require port 4004 to remain open. ↗
• · SIMATIC PCS neo V4.1 and V5.0 have no fix currently planned; mitigation relies solely on network-level controls (port blocking, firewall isolation). ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121