Sign-up

ID

VAR-202505-1698


CVE

CVE-2025-40566


TITLE

Siemens'  SIMATIC PCS neo  Session deadline vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2025-012291

DESCRIPTION

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens' SIMATIC PCS neo contains a session expiration vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2025-40566 // JVNDB: JVNDB-2025-012291

AFFECTED PRODUCTS

vendor:siemensmodel:simatic pcs neoscope:eqversion:4.1

Trust: 1.0

vendor:siemensmodel:simatic pcs neoscope:eqversion:5.0

Trust: 1.0

vendor:siemensmodel:simatic pcs neoscope:ltversion:5.0

Trust: 1.0

vendor:siemensmodel:simatic pcs neoscope:ltversion:4.1

Trust: 1.0

vendor:シーメンスmodel:simatic pcs neoscope:eqversion:4.1

Trust: 0.8

vendor:シーメンスmodel:simatic pcs neoscope:eqversion: -

Trust: 0.8

vendor:シーメンスmodel:simatic pcs neoscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:simatic pcs neoscope:eqversion:5.0

Trust: 0.8

sources: JVNDB: JVNDB-2025-012291 // NVD: CVE-2025-40566

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2025-40566
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2025-40566
value: CRITICAL

Trust: 1.0

NVD: CVE-2025-40566
value: CRITICAL

Trust: 0.8

productcert@siemens.com: CVE-2025-40566
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-40566
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2025-40566
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2025-012291 // NVD: CVE-2025-40566 // NVD: CVE-2025-40566

PROBLEMTYPE DATA

problemtype:CWE-613

Trust: 1.0

problemtype:Inappropriate session deadline (CWE-613) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-012291 // NVD: CVE-2025-40566

EXTERNAL IDS

db:NVDid:CVE-2025-40566

Trust: 2.6

db:SIEMENSid:SSA-339086

Trust: 1.8

db:JVNid:JVNVU92528757

Trust: 0.8

db:ICS CERTid:ICSA-25-135-12

Trust: 0.8

db:JVNDBid:JVNDB-2025-012291

Trust: 0.8

sources: JVNDB: JVNDB-2025-012291 // NVD: CVE-2025-40566

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-339086.html

Trust: 1.8

url:https://jvn.jp/vu/jvnvu92528757/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-40566

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-12

Trust: 0.8

sources: JVNDB: JVNDB-2025-012291 // NVD: CVE-2025-40566

SOURCES

db:JVNDBid:JVNDB-2025-012291
db:NVDid:CVE-2025-40566

LAST UPDATE DATE

2025-08-26T21:48:04.527000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2025-012291date:2025-08-25T06:50:00
db:NVDid:CVE-2025-40566date:2025-08-22T20:28:42.893

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2025-012291date:2025-08-25T00:00:00
db:NVDid:CVE-2025-40566date:2025-05-13T10:15:26.183