CVE-2025-40938
published 2025-12-09CVE-2025-40938: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could…
PriorityP359critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.33%
25.1th percentile
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_cn_4100 | < V4.0.1 | V4.0.1 |
| siemens | simatic_cn_4100_firmware | < 4.0.1 | 4.0.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC CN 4100
cisa_ics·2025-12-09·CVSS 8.3
[HIGH] Siemens SIMATIC CN 4100
ICS Advisory
##
Siemens SIMATIC CN 4100
Release DateDecember 09, 2025
Alert CodeICSA-26-015-12
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
The following versions of Siemens SIMATIC CN 4100 are affected:
- SIMATIC CN 4100 (CVE-2025-40937, CVE-2025-40938, CVE-2025-40939, CVE-2025-40940, CVE-2025-40941)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 8.3
| Siemens
| Siemens SIMATIC CN 4100
| Improper Neutralization of Special Elements used in a Command ('Comma
GHSA
GHSA-6wrx-4m6w-9vw2: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
ghsa_unreviewed·2025-12-09
CVE-2025-40938 [CRITICAL] CWE-798 GHSA-6wrx-4m6w-9vw2: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-09
Published