PT-2025-49842 · Siemens · Simatic Cn 4100

CVE-2025-40937 · Published 2025-12-09 · Updated 2025-12-09

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to 4.0.1

Description The application does not properly validate input parameters in its REST API, leading to improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges. The vulnerable component is the REST API, specifically its handling of input parameters.

Recommendations Update to version 4.0.1 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2026-00140

CVE-2025-40937

Affected Products

Simatic Cn 4100

References · 5

• https://cert-portal.siemens.com/productcert/html/ssa-416652.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00140 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40937 · Security Note
• https://twitter.com/CVEnew/status/1998355318506708996 · Twitter Post