Vulnerability details

CVE-2025-40798

Siemens SIMATIC PCS neoSiemens User Management Component

CVSS 4.0

8.7High

Official description

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (siemens)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (siemens)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
Siemens	SIMATIC PCS neo V4.1	All	CVEProject cvelistV5 (CNA)
Siemens	SIMATIC PCS neo V5.0	All	CVEProject cvelistV5 (CNA)
Siemens	SIMATIC PCS neo V6.0	v < V6.0 SP1 Update 1	CVEProject cvelistV5 (CNA)
Siemens	User Management Component (UMC)	v < V2.15.1.3	CVEProject cvelistV5 (CNA)

References and advisories

https://cert-portal.siemens.com/productcert/html/ssa-722410.html

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-09-09
Last updated: 2026-06-09
State: Published
Assigner (CNA): siemens

Exploit prediction (EPSS)

0.53%

Probability of exploitation in 30 days

45.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-125
Out-of-bounds Read