PatchTheCEVCVE-2025-40797: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions
42
This month
HIGH 7.5REMOTEDOWNGRADEUPGRADE
CVE-2025-40797 is a high-severity flaw (CVSS 7.5) affecting simatic pcs neo, user management component. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 55%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2025-09-09 |
| Last modified | 2026-10-23 |
Publisher (CNA): Siemens AG · Vendor: siemens
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
siemens simatic pcs neo DOWNGRADE
Affected: 4.1 · 5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.1
1. Check installed version
apt-cache policy simatic-pcs-neo || rpm -q simatic-pcs-neo || simatic-pcs-neo --version
2. No fixed release: DOWNGRADE to a release before 4.1 (Debian / Ubuntu)
apt-cache madison simatic-pcs-neo
sudo apt install simatic-pcs-neo=<VERSION_BEFORE_4.1>
sudo apt-mark hold simatic-pcs-neo
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list simatic-pcs-neo
sudo dnf downgrade simatic-pcs-neo-<VERSION_BEFORE_4.1>
sudo dnf versionlock add simatic-pcs-neo
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
siemens user management component UPGRADE
Affected: < 2.15.1.3
Fixed in: 2.15.1.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy user-management-component || rpm -q user-management-component || user-management-component --version
2. UPGRADE to 2.15.1.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade user-management-component
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade user-management-component
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2025-40795 CRITICAL 9.8 DOWNGRADE UPGRADE A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions
- CVE-2025-40796 HIGH 7.5 DOWNGRADE UPGRADE A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions
- CVE-2025-40798 HIGH 7.5 DOWNGRADE UPGRADE A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions