CVE-2025-40938

HIGH

SIMATIC CN 4100 < 4.0.1 - Use of Hard-coded Credentials

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.

References (1)

Core 1

Scores

CVSS v3 8.1
EPSS 0.0032
EPSS Percentile 23.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-798
Status published
Products (1)
siemens/simatic_cn_4100_firmware < 4.0.1
Published Dec 09, 2025
Tracked Since Feb 18, 2026