CVE-2025-40796highCWE-125

CVE-2025-40796: high-severity vulnerability in Siemens SIMATIC PCS neo V4.1

Published · Updated

Follow this CVE+ Monitor SIMATIC PCS neo+ Monitor User Management Component

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Siemens · SIMATIC PCS neo V4.1Siemens · SIMATIC PCS neo V5.0Siemens · SIMATIC PCS neo V6.0Siemens · User Management Component (UMC)
Related CVEs — Siemens SIMATIC PCS neo V4.1

In the same product, most dangerous first.

CVE-2024-49775CRITICALCVE-2024-49775EPSS 1.5%CVE-2024-33698CRITICALCVE-2024-33698EPSS 1.1%CVE-2025-40795CRITICALCVE-2025-40795EPSS 0.7%CVE-2025-30176HIGHCVE-2025-30176EPSS 0.7%CVE-2025-30175HIGHCVE-2025-30175EPSS 0.7%CVE-2025-30174HIGHCVE-2025-30174EPSS 0.7%