---
id: CVE-2025-40937
title: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1)
summary: "A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments.\r\nThis could allow…"
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-77
vendor: siemens
product: simatic_cn_4100_firmware
affected:
  - simatic_cn_4100_firmware < 4.0.1
patched:
  - simatic_cn_4100_firmware 4.0.1
published: '2025-12-09'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T20:10:01.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40937'
references:
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-416652.html'
    label: productcert@siemens.com
tags:
  - nvd
epss: 0.00586
epssPercentile: 0.46225
ingestedAt: '2026-10-07T20:46:46.791Z'
---

## Overview

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments.
This could allow an authenticated attacker to execute arbitrary code with limited privileges.

## Affected

- `simatic_cn_4100_firmware < 4.0.1`

## Remediation

Upgrade past the affected range:

- `simatic_cn_4100_firmware 4.0.1`