CVE-2025-40797

HighCVSS 7.5

Published: 09/09/2025(UTC)Updated: 09/06/2026(UTC)Translated: 10/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

36th percentile - higher than 36% of all known CVEs

Summary

A vulnerability has been identified in SIMATIC PCS neo versions V4.1, V5.0, and V6.0 (all versions < V6.0 SP1 Update 1) and in the User Management Component (UMC) (all versions < V2.15.1.3). This vulnerability involves an out-of-bounds read in the integrated UMC component.

Risk Assessment

This vulnerability could allow an unauthenticated remote attacker to cause a denial of service condition, potentially disrupting system operations.

Recommendation

It is recommended to update to the latest software versions to mitigate this vulnerability and to monitor the system for unauthorized access attempts.

Other vulnerabilities in SIMATIC PCS neo V4.1, V5.0, V6.0 (wszystkie wersje < V6.0 SP1 Update 1), User Management Component (UMC) (wszystkie wersje < V2.15.1.3)

CVE-2025-40798High
A vulnerability has been identified in SIMATIC PCS neo versions V4.1, V5.0, and V6.0 (all versions < V6.0 SP1 Update 1) and in the User Management Component (UMC) (all versions < V2.15.1.3). This vulnerability involves an out-of-bounds read in the integrated UMC component.

Original NVD description (English source)

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.