What is CVE-2025-40940?

CVE-2025-40940 is a medium-severity vulnerability in Siemens Simatic Cn 4100, classified under Information Disclosure. CVSS score: 4.9/10. Published 2025-12-09.

How severe is CVE-2025-40940?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Information disclosure in Siemens Simatic Cn 4100

CVE-2025-40940

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpected service availability and unreliable configuration handling across protocol versions. This could allow an attacker to access sensitive data, potentially leading to a breach of confidentiality.

Vulnerability class: Information Disclosure

EPSS: 0.004 (29.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

productcert@siemens.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-40940?: CVE-2025-40940 is a medium-severity vulnerability in Siemens Simatic Cn 4100, classified under Information Disclosure. CVSS score: 4.9/10. Published 2025-12-09.
How severe is CVE-2025-40940?: Medium severity. CVSS v3 base score is 4.9 out of 10.