Which versions of SIMATIC CN 4100 are affected by CVE-2026-22925?

Siemens SIMATIC CN 4100 devices running versions before V5.0 are vulnerable to remote denial-of-service attacks via TCP SYN flooding, rendering industrial control systems completely unavailable…

How to fix or mitigate CVE-2026-22925?

Within 24 hours: Inventory all Siemens SIMATIC CN 4100 deployments and identify current firmware versions; implement network-level SYN flood protection (rate limiting, SYN cookies) at perimeter firewalls and switches. Within 7 days: Restrict network access to affected devices using firewall rules or network segmentation, limiting TCP connections to only authorized management and operational networks. Within 30 days: Upgrade all SIMATIC CN 4100 devices to V5.0 or later when available; if upgrade readiness is uncertain, escalate to operational technology leadership for scheduled maintenance window.

SIMATIC CN 4100 CVE-2026-22925

Q: What is the CVSS score of CVE-2026-22925?

CVE-2026-22925 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29424 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-12 siemens

GHSA-45ff-x9p5-mq3g

Denial Of Service Simatic Cn 4100

8.7

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (siemens) · only source for this CVE.

CVSS VectorVendor: siemens

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 12, 2026 - 10:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 12, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

May 12, 2026 - 10:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 12, 2026 - 10:02 vuln.today

CVE Published

May 12, 2026 - 08:20 nvd

HIGH 7.5

DescriptionCVE.org

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.

AnalysisAI

Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute.

Technical ContextAI

SIMATIC CN 4100 is an industrial Ethernet communications module used in Siemens automation environments for network connectivity and protocol conversion. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the device lacks proper rate limiting or resource quotas for handling TCP connection establishment requests. Classic SYN flood attacks exploit the TCP three-way handshake by sending massive volumes of SYN packets without completing connections, forcing the target to maintain half-open connection state in memory until timeout. Industrial control system components like the CN 4100 often prioritize deterministic performance over DDoS mitigation, making them particularly vulnerable to volumetric attacks when exposed to untrusted networks.

RemediationAI

Upgrade SIMATIC CN 4100 firmware to version V5.0 or later as specified in Siemens ProductCERT advisory SSA-032379 available at https://cert-portal.siemens.com/productcert/html/ssa-032379.html. For systems where immediate patching is not feasible, implement network-layer compensating controls: deploy stateful firewalls or industrial DMZ architectures to restrict CN 4100 access to only trusted OT network segments, preventing external or corporate network SYN flood attacks (trade-off: requires network redesign and may impact remote access capabilities). Configure upstream network infrastructure with SYN flood protection mechanisms such as SYN cookies, connection rate limiting, or dedicated DDoS mitigation appliances positioned before the CN 4100 (trade-off: adds complexity and potential points of failure; may impact legitimate high-volume automation traffic if thresholds set incorrectly). Implement network monitoring to detect abnormal SYN packet volumes targeting the device for early attack detection.