SIMATIC CN 4100 CVE-2025-40941

Exploitation requires network access to the SIMATIC CN 4100 device plus low-level privileges (CVSS PR:L), meaning the attacker must already be able to authenticate or hold some valid access to the device's services; it is not exploitable by a fully unauthenticated remote attacker. The affected device must be running firmware below V4.0.1. No user interaction is required (UI:N) and attack complexity is low (AC:L), but impact is confined to disclosure of server information in responses - limiting factors are the required privilege level and the fact that the leaked data only aids reconnaissance rather than directly compromising the device.

This is a low-to-moderate severity information disclosure issue (CWE-200) that is unlikely to be a standalone priority. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L), so it is not an unauthenticated flaw. Impact is limited to confidentiality (VC:L) with no integrity or availability effect, matching the description's claim that the device merely 'exposes server information in its responses.' The EPSS score of 0.28% (19th percentile) is low, indicating little evidence of broad exploitation interest, and the CVE is not in CISA KEV with no public exploit identified - all signals are mutually consistent and point to a minor, chainable reconnaissance weakness rather than an urgent fix. The description itself frames this as 'increasing the likelihood of targeted attacks,' i.e., an enabler for follow-on activity rather than a direct compromise. No signals conflict; the primary caveat is that only Siemens' own advisory and NVD-derived CPE data are available, so affected-version boundaries rely on the vendor advisory alone.

An attacker with network access and low-level credentials to a SIMATIC CN 4100 running a version below V4.0.1 sends requests to the device and observes verbose server information disclosed in the responses. The leaked details (such as software/server identifiers) help the attacker fingerprint the device and tailor subsequent targeted attacks. No public exploit code is identified, and exploitation yields information disclosure only, not direct code execution or state change.