CVE-2025-40941
published 2025-12-09CVE-2025-40941: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses. This could…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.25%
15.8th percentile
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses.
This could allow an attacker with network access to gain useful information, increasing the likelihood of targeted attacks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_cn_4100 | < V4.0.1 | V4.0.1 |
| siemens | simatic_cn_4100_firmware | < 4.0.1 | 4.0.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC CN 4100
cisa_ics·2025-12-09·CVSS 8.3
[HIGH] Siemens SIMATIC CN 4100
ICS Advisory
##
Siemens SIMATIC CN 4100
Release DateDecember 09, 2025
Alert CodeICSA-26-015-12
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
The following versions of Siemens SIMATIC CN 4100 are affected:
- SIMATIC CN 4100 (CVE-2025-40937, CVE-2025-40938, CVE-2025-40939, CVE-2025-40940, CVE-2025-40941)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 8.3
| Siemens
| Siemens SIMATIC CN 4100
| Improper Neutralization of Special Elements used in a Command ('Comma
GHSA
GHSA-4cw5-4fh5-2c5q: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
ghsa_unreviewed·2025-12-09
CVE-2025-40941 [MEDIUM] CWE-200 GHSA-4cw5-4fh5-2c5q: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses.
This could allow an attacker with network access to gain useful information, increasing the likelihood of targeted attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-09
Published