CVE-2025-40940
published 2025-12-09CVE-2025-40940: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as…
PriorityP428medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.32%
24.0th percentile
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpected service availability and unreliable configuration handling across protocol versions. This could allow an attacker to access sensitive data, potentially leading to a breach of confidentiality.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_cn_4100 | < V4.0.1 | V4.0.1 |
| siemens | simatic_cn_4100_firmware | < 4.0.1 | 4.0.1 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC CN 4100
cisa_ics·2025-12-09·CVSS 8.3
[HIGH] Siemens SIMATIC CN 4100
ICS Advisory
##
Siemens SIMATIC CN 4100
Release DateDecember 09, 2025
Alert CodeICSA-26-015-12
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
The following versions of Siemens SIMATIC CN 4100 are affected:
- SIMATIC CN 4100 (CVE-2025-40937, CVE-2025-40938, CVE-2025-40939, CVE-2025-40940, CVE-2025-40941)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 8.3
| Siemens
| Siemens SIMATIC CN 4100
| Improper Neutralization of Special Elements used in a Command ('Comma
GHSA
GHSA-2cx9-pwfc-xwx3: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
ghsa_unreviewed·2025-12-09
CVE-2025-40940 [MEDIUM] CWE-200 GHSA-2cx9-pwfc-xwx3: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpected service availability and unreliable configuration handling across protocol versions. This could allow an attacker to access sensitive data, potentially leading to a breach of confidentiality.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-09
Published