PT-2025-49843 · Siemens · Simatic Cn 4100

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-40938

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to 4.0.1

Description The device stores sensitive information in its firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.

Recommendations Update to version 4.0.1 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2026-00141

CVE-2025-40938

Affected Products

Simatic Cn 4100

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-40938 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-416652.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00141 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40938 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998355317445599558 · Twitter Post