Vulnerability · Published Dec 9, 2025 · Assigned by siemens

CVE-2025-40818

Low 3.3

In plain English

A low-severity incorrect permission assignment in SINEMA Remote Connect Server from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.1%top 99.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.

Affected products (as reported)

Vendor	Product	Versions
Siemens	SINEMA Remote Connect Server	0 – before V3.2 SP4

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://cert-portal.siemens.com/productcert/html/ssa-626856.html