CVE-2025-40937

CWE-77 — Command Injection4 documents4 sources
Severity
8.7HIGH
EPSS
0.1%
top 65.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Siemens Simatic CN 4100Siemens Simatic CN 4100 Firmware
Timeline
PublishedDec 9

Description

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5siemens/simatic_cn_4100< V4.0.1

🔴Vulnerability Details

2
CVEList
CVE-2025-40937: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4↗2025-12-09
▶
GHSA
GHSA-f729-p9c9-fm58: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4↗2025-12-09
▶