PT-2025-36681 · Siemens · Simatic Pcs Neo+1

Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-40795

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions 4.1 (All versions) SIMATIC PCS neo versions 5.0 (All versions) User Management Component (UMC) versions prior to 2.15.1.3

Description: A stack-based buffer overflow vulnerability exists in the integrated User Management Component (UMC). This could allow an unauthenticated remote attacker to execute arbitrary code or cause a denial of service condition.

Recommendations: Update User Management Component (UMC) to version 2.15.1.3 or later. Update SIMATIC PCS neo version 4.1 to a newer version. Update SIMATIC PCS neo version 5.0 to a newer version.

Fix

RCE

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2025-40795

Affected Products

Simatic Pcs Neo

User Management

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-40795 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40795 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-722410.html · Vendor Advisory
• https://t.me/pentestingnews/67818 · Telegram Post
• https://t.me/CVEtracker/32050 · Telegram Post
• https://twitter.com/CVEnew/status/1965338913523872218 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965384684541554716 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1965350079616651289 · Twitter Post
• https://twitter.com/fridaysecurity/status/1965434046567395748 · Twitter Post