PT-2025-49842 · Siemens · Simatic Cn 4100

CVE-2025-40937 · Publicado 2025-12-09 · Atualizado 2025-12-09

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to 4.0.1

Description The application does not properly validate input parameters in its REST API, leading to improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges. The vulnerable component is the REST API, specifically its handling of input parameters.

Recommendations Update to version 4.0.1 or later.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2026-00140

CVE-2025-40937

Produtos afetados

Simatic Cn 4100

Referências · 5

• https://cert-portal.siemens.com/productcert/html/ssa-416652.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-00140 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-40937 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1998355318506708996 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-40937 · Nota de Segurança