Full Report
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in SIMATIC CN 4100
## CVE Details
- **CVE-2025-40937**: CVSS 3.1: 8.3 (High) | CVSS 4.0: 8.7 | CWE-77 (Command Injection)
- **CVE-2025-40938**: CVSS 3.1: 8.1 (High) | CVSS 4.0: 9.2 | CWE-798 (Hard-coded Credentials)
- **CVE-2025-40939**: CVSS 3.1: 4.6 (Medium) | CVSS 4.0: 5.1 | CWE-284 (Improper Access Control)
- **CVE-2025-40940**: CVSS 3.1: 4.9 (Medium) | CVSS 4.0: 6.9 | CWE-200 (Information Exposure)
- **CVE-2025-40941**: CVSS 3.1: 4.3 (Medium) | CVSS 4.0: 5.3 | CWE-200 (Information Exposure)
## Affected Systems
- **Products**: SIMATIC CN 4100 (Communication Node for process control technology)
- **Versions**: All versions prior to V4.0.1
- **Configurations**: Default installations; systems with REST API enabled, SNMP configured, or physically accessible USB ports.
## Vulnerability Description
The SIMATIC CN 4100 platform is impacted by five distinct security flaws:
1. **Command Injection (CVE-2025-40937)**: The REST API fails to validate input parameters, allowing authenticated users to inject arguments and execute arbitrary code.
2. **Hard-coded Credentials (CVE-2025-40938)**: Sensitive information (credentials) is stored within the firmware, which could be extracted and used to compromise the device.
3. **Physical DoS (CVE-2025-40939)**: Unauthenticated access to the physical USB port allows an attacker to trigger a device reboot.
4. **SNMP Information Leak (CVE-2025-40940)**: Inconsistent handling of SNMP protocol versions and configurations allows high-privileged attackers to access sensitive data.
5. **Server Banner Leak (CVE-2025-40941)**: The device explicitly exposes server information in network responses, facilitating reconnaissance for targeted attacks.
## Exploitation
- **Status**: No known exploitation in the wild; no public PoC currently listed.
- **Complexity**: Low (most CVEs), High (CVE-2025-40938 / CVE-2025-40937 context).
- **Attack Vector**:
- **Network**: CVE-2025-40937, CVE-2025-40938, CVE-2025-40940, CVE-2025-40941
- **Physical**: CVE-2025-40939
## Impact
- **Confidentiality**: High (Access to firmware secrets, REST API data, and SNMP info).
- **Integrity**: High (Arbitrary code execution and credential misuse).
- **Availability**: High (Ability to trigger reboots and service disruptions).
## Remediation
### Patches
- **SIMATIC CN 4100 V4.0.1**: Siemens recommends updating to V4.0.1 or later.
- Download Link: [https://support.industry.siemens.com/cs/ww/en/view/109814144/](https://support.industry.siemens.com/cs/ww/en/view/109814144/)
### Workarounds
- **Network Segmentation**: Protect network access to devices using firewalls and VLANs.
- **Physical Security**: Limit physical access to the device to prevent USB-based reboots.
- **Operational Guidelines**: Adhere to Siemens’ Industrial Security guidelines to ensure a protected IT environment.
## Detection
- **Indicators of Compromise**:
- Unexplained reboots (potentially indicating USB or injection exploitation).
- Unusual REST API traffic or unexpected authenticated sessions.
- Unauthorized SNMP polling from administrative or unknown IPs.
- **Detection methods**: Monitor network logs for REST API parameter anomalies and audit firmware integrity where possible.
## References
- **Siemens Security Advisory (SSA-416652)**: hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-416652[.]html
- **Siemens Industrial Security Guidelines**: hxxps://www[.]siemens[.]com/cert/operational-guidelines-industrial-security