SIMATIC CN 4100 CVE-2025-40939

Requires direct PHYSICAL access to the SIMATIC CN 4100's USB port, which accepts unauthenticated connections; the attacker uses this interface to trigger a device reboot. Exploitation is strictly limited by the need for on-site physical presence (AV:P) - it cannot be performed remotely or over the network - and the impact is confined to a temporary availability loss (device reboot/DoS) against affected firmware versions below V4.0.1, with no confidentiality or integrity consequences and no code execution.

This is a genuinely low-priority issue despite the MEDIUM 5.1 CVSS 4.0 score. The vendor-supplied CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: exploitation requires PHYSICAL access to the device's USB port, and the only impact is availability (VA:H) via a forced reboot - there is no confidentiality or integrity impact (VC:N/VI:N). The physical attack vector is the dominant risk-limiting factor and is the single most important signal here. EPSS corroborates the low urgency at 0.21% (11th percentile), consistent with a flaw that cannot be exploited remotely or at scale. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. One minor note: although the CVSS vector carries PR:N (no privileges), the description frames the USB port as allowing 'unauthenticated connections' - PR:N reflects the lack of logical authentication, not an absence of the physical-presence barrier captured by AV:P. There are no conflicting signals: a physically-local, availability-only DoS in an industrial communication node is low real-world priority and should be handled as a routine patch, not an emergency.

An attacker with physical access to a deployed SIMATIC CN 4100 inserts or manipulates a device on its unauthenticated USB port, causing the unit to reboot and dropping the communication services it provides until it restarts. No public exploit code is known, and the attack yields only a temporary denial of service with no data access or code execution.