Vulnerability · Published Dec 9, 2025 · Assigned by siemens
CVE-2025-40938
High 8.1
In plain English
A high-severity hard-coded credentials in SIMATIC CN 4100 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC CN 4100 | 0 – before V4.0.1 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H