What’s Vulnerable › Vulnerabilities
CVE-2025-40566
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-13 · updated 2026-06-17
- Weakness: CWE-613
Description
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Affected products
- Siemens SIMATIC PCS neo: before 4.1; before 5.0; 4.1-update_1, 4.1-update_2, 5.0 — fixed in 4.1, 5.0
How to fix
Upgrade to a fixed version: Siemens SIMATIC PCS neo 4.1, 5.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-40566 or the next vulnerability affects your stack