CVE-2025-40937: Command Injection
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments. This could allow an authenticated attacker to execute arbitrary code with limited privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40937?
CVE-2025-40937 is considered a critical vulnerability due to the potential for arbitrary code execution by authenticated attackers.
How do I fix CVE-2025-40937?
To fix CVE-2025-40937, upgrade to version 4.0.1 or later of the SIMATIC CN 4100 software.
What systems are affected by CVE-2025-40937?
CVE-2025-40937 affects all versions of Siemens SIMATIC CN 4100 prior to version 4.0.1.
Can CVE-2025-40937 be exploited remotely?
CVE-2025-40937 requires authentication, meaning an attacker must have valid credentials to exploit the vulnerability.
What kind of attacks can CVE-2025-40937 allow?
CVE-2025-40937 can allow authenticated attackers to execute arbitrary code, potentially compromising the integrity of the system.