PT-2025-36687 · Siemens · Simatic Virtualization As A Service

Published 2025-09-09 · Updated 2025-09-10 · CVE-2025-40804

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: SIMATIC Virtualization as a Service (SIVaaS) (affected versions not specified)

Description: The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization, potentially leading to data leaks.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-14338

CVE-2025-40804

Affected Products

Simatic Virtualization As A Service

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-40804 · Security Note
• https://bdu.fstec.ru/vul/2025-14338 · Security Note
• https://twitter.com/VulmonFeeds/status/1965369325763649620 · Twitter Post
• https://twitter.com/CVEnew/status/1965338907198816743 · Twitter Post
• https://twitter.com/fridaysecurity/status/1965573617414193553 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-534283.html · Note
• https://t.me/CVEtracker/32056 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1965352435485991235 · Twitter Post