SIMATIC CN 4100 CVE-2025-40940

Exploitation requires an attacker with HIGH privileges (PR:H) who can reach the CN 4100's SNMP interface over the network (AV:N); the specific prerequisite is the device's SNMP service being enabled and queried, where behavior is inconsistent across SNMP protocol versions (e.g., a version unexpectedly available or configuration applied unreliably), allowing privileged access to sensitive data. Limiting factors: the attacker must already be authenticated/privileged, so this is not remotely exploitable by an anonymous attacker; impact is confined to confidentiality (no integrity or availability effect); and all versions below V4.0.1 are affected, so patched or newer firmware removes the condition.

This is a moderate-severity information-disclosure issue (CVSS 4.0 base 6.9) that in practice sits toward the lower end of operational priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) shows a network-reachable, low-complexity flaw but one that requires HIGH privileges (PR:H) and yields only confidentiality impact with no integrity or availability effect and no scope change - so an attacker must already hold privileged/authenticated access before the inconsistent SNMP behavior can be abused to read sensitive data. The EPSS score of 0.37% (28th percentile) is low and consistent with this picture: there is no CISA KEV listing and no public exploit identified, so there is no confirmed active exploitation. The signals are mutually consistent rather than conflicting - a high-impact-to-confidentiality but privilege-gated bug in a specialized industrial device, with low predicted exploitation. The main caveat is the PR:H requirement: if an operator exposes SNMP management to a wider network or shares community strings, the practical privilege barrier may be lower than the vector implies. Treat as a routine-to-moderate patch priority rather than an emergency.

An attacker who already holds privileged/authenticated management access to a SIMATIC CN 4100 sends SNMP queries and exploits the device's inconsistent behavior across SNMP protocol versions - where a service is unexpectedly available or configuration handling is unreliable - to read sensitive configuration or operational data that should not be exposed. No public exploit code is identified at the time of analysis, and no user interaction is required (UI:N), but the attacker needs high privileges (PR:H) to begin.