SIMATIC CN 4100 CVE-2025-40937

Exploitation requires (1) network access to the device's REST API endpoint and (2) valid authenticated credentials to that API (PR:L), after which the attacker sends unexpected/unvalidated argument values to inject commands. Limiting factors: the attacker must already be authenticated (not an anonymous remote attacker), resulting code execution runs only with limited privileges per the advisory (not root/admin), and only firmware versions below V4.0.1 are affected - upgrading to V4.0.1 or later removes exposure. No end-user interaction is required (UI:N).

This is a moderate-to-serious priority rather than an emergency. The vendor-issued CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) scores 8.7 (High) and indicates network-reachable, low-complexity exploitation with no user interaction, but it explicitly requires low-level privileges (PR:L) - meaning the attacker must already be an authenticated user of the REST API. That authentication requirement, combined with the description's own note that resulting code execution is 'with limited privileges,' meaningfully tempers the real-world risk. Exploitation signals are weak-to-neutral: EPSS is only 0.59% (46th percentile), there is no CISA KEV listing, and no public exploit code was identified, so there is no public exploit identified at time of analysis. The signals are internally consistent - a high technical-impact flaw (command injection, CWE-77) gated behind authentication and yielding only limited privileges, with no evidence of active or imminent mass exploitation. No SSVC decision data was provided in the input. Net: patch on a normal prioritized cadence; it is not a drop-everything issue absent evidence of targeting against the specific affected ICS device.

An attacker who already holds valid (low-privilege) credentials for the SIMATIC CN 4100's REST API submits a request containing crafted/unexpected argument values that the API fails to validate, injecting operating-system commands (CWE-77). The injected commands execute on the device with limited privileges, giving the attacker a foothold on the communication node. No public proof-of-concept exploit is known at time of analysis.