What’s Vulnerable › Vulnerabilities

CVE-2025-40805

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-639

Description

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate user.

Affected products

• Siemens Industrial Edge Cloud Device (IECD): before V1.24.2 — fixed in V1.24.2
• Siemens Industrial Edge Device Kit - arm64 V1.10: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.11: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.12: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.13: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.14: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.15: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.16: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.17: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.18: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.19: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.20: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.21: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.22: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.23: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.24: before V1.24.2 — fixed in V1.24.2
• Siemens Industrial Edge Device Kit - arm64 V1.25: before V1.25.1 — fixed in V1.25.1
• Siemens Industrial Edge Device Kit - arm64 V1.5: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.6: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.7: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.8: all versions
• Siemens Industrial Edge Device Kit - arm64 V1.9: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.10: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.11: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.12: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.13: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.14: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.15: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.16: all versions
• Siemens Industrial Edge Device Kit - x86-64 V1.17: all versions

How to fix

Upgrade to a fixed version: Siemens Industrial Edge Cloud Device (IECD) V1.24.2; Siemens Industrial Edge Device Kit - arm64 V1.24 V1.24.2; Siemens Industrial Edge Device Kit - arm64 V1.25 V1.25.1; Siemens Industrial Edge Device Kit - x86-64 V1.24 V1.24.2; Siemens Industrial Edge Device Kit - x86-64 V1.25 V1.25.1; Siemens Industrial Edge Own Device (IEOD) V1.24.2; Siemens Industrial Edge Virtual Device (IEVD) V1.24.2; Siemens SCALANCE LPE9413 V2.2; Siemens SCALANCE LPE9433 V2.2; Siemens SIMATIC Automation Workstation 19" V1.3; Siemens SIMATIC Automation Workstation 24" V1.3; Siemens SIMATIC HMI MTP1000 Unified Comfort Panel V21. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/html/ssa-001536.html
• https://cert-portal.siemens.com/productcert/html/ssa-014678.html

Get alerted when CVE-2025-40805 or the next vulnerability affects your stack