CVE Alert: CVE-2025-40797 – Siemens – SIMATIC PCS neo V4.1

Risk verdict

High risk of unauthenticated remote denial-of-service against the affected Siemens SIMATIC PCS neo and UMC components; exploitation urgency cannot be confirmed from KEV/SSVC data in this record.

Why this matters

An unauthenticated remote trigger could disable critical industrial management interfaces, risking production downtime and potential safety systems disruption. With no user interaction required, the attacker’s goal is disruption of availability across PLC management workflows, which could cascade into manufacturing line stoppages.

Most likely attack path

• No authentication required and no user interaction needed, meaning remote network access to the vulnerable UMC/PCS neo surface is the main precondition.
• An attacker could send crafted requests to trigger an out-of-bounds read, causing a denial of service and service instability.
• Lateral movement is unlikely to achieve persistence from a DoS, but initial access sufficient to disable management capabilities could negate operator controls across affected sites.

Who is most exposed

Facilities deploying SIMATIC PCS neo in connected industrial networks, especially where UMC is exposed to wider network access or remote engineering stations, are most at risk. Typical exposure patterns include ICS networks with internet-facing gateways or permissive lateral movement to management components.

Detection ideas

• Sudden crashes or restarts of PCS neo/UCM services with associated fault or watchdog logs.
• Unusual spikes in memory/CPU on management components.
• Anomalous inbound network traffic to UMC/PCS neo endpoints from untrusted hosts.
• Repeated failed or unusual SNMP/OPC/management-protocol requests prior to a crash.
• IDS alerts for anomalous crafted inputs targeting management interfaces.

Mitigation and prioritisation

• Apply vendor-supplied patches to UMC (≤V2.15.1.3) and affected PCS neo versions as a priority; advance to patched builds when available.
• Implement network access controls: restrict management interfaces to authorised engineering workstations; segment ICS networks and enforce least privilege.
• Disable or tightly constrain remote access to UMC/PCS neo; enforce MFA where feasible and log all access.
• Monitor and alert on abnormal service crashes, reboots, or degraded availability in ICS environments.
• If KEV is true or EPSS ≥ 0.5, treat as priority 1.