CVE-2025-40938

critical · 9.2

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.

9.2

CVSS

0.4%

EPSS (exploit prob.)

32nd

EPSS percentile

2025-12-09

Published

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
siemens	simatic_cn_4100_firmware	< 4.0.1
siemens	simatic_cn_4100	all versions

Check a specific version with /api/v1/cve/match.

References

https://cert-portal.siemens.com/productcert/html/ssa-416652.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-40938