Simatic Cn 4100 Firmware
Monthly
SIMATIC CN 4100 devices running firmware versions before V4.0.1 expose server information in their responses, enabling an authenticated attacker with low-level privileges and network access to gain reconnaissance details that could increase the likelihood of targeted attacks. The vulnerability requires authentication (PR:L per CVSS 4.0 vector) and has low confidentiality impact, with an EPSS score of 0.28% (19th percentile) and no public exploit identified at time of analysis. Siemens has released firmware V4.0.1 to address the issue.
Inconsistent SNMP behavior in Siemens SIMATIC CN 4100 firmware versions below V4.0.1 lets an authenticated, highly privileged attacker who can reach the device's SNMP interface read sensitive data, producing a confidentiality-only impact with no effect on integrity or availability. The flaw manifests as unexpected service availability or unreliable configuration handling across SNMP protocol versions, meaning a protocol version that should not be exposed may become reachable, or configuration changes may not be applied as expected. No public exploit code has been identified at time of analysis, and exploitation is not confirmed as active; EPSS is low at 0.37% (28th percentile), so this moderate-severity issue (CVSS 4.0 base 6.9) sits toward the lower end of operational priority. Siemens has released firmware V4.0.1, which removes the affected condition.
Unauthenticated access to the USB port on Siemens SIMATIC CN 4100 devices (all firmware versions below V4.0.1) allows an attacker with direct physical access to trigger a device reboot, resulting in a denial-of-service condition. The CVSS 4.0 score of 5.1 reflects a strictly physical attack vector (AV:P) - the flaw cannot be reached remotely or across the network - and the impact is confined to availability, with no confidentiality, integrity, or code-execution consequences. The EPSS score is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the vendor has released firmware V4.0.1 to address the issue.
SIMATIC CN 4100 devices running firmware versions below V4.0.1 store sensitive credentials and keys in a hard-coded, recoverable form within the firmware image, allowing anyone who obtains and analyzes that image to extract secrets that apply across all devices of the same version. Siemens rates this 9.2 (Critical) under CVSS 4.0 with full High confidentiality, integrity and availability impact to the device itself; the practical barrier is that an attacker must first acquire a firmware image and have the capability to reverse it, which is why the vector carries AC:H despite being unauthenticated (PR:N/UI:N). No public exploit code or confirmed active exploitation has been identified at time of analysis (EPSS 0.38%, 30th percentile), and the issue is fixed in firmware V4.0.1.
Authenticated command injection in the REST API of Siemens SIMATIC CN 4100 firmware versions below V4.0.1 allows a user who already holds valid API credentials to pass unexpected argument values that are not properly validated, resulting in execution of arbitrary code with limited privileges on the controller. Exploitation requires both network reachability to the REST API endpoint and authenticated access (CVSS vector PR:L), so it is not an anonymous, drive-by attack, and the resulting code runs at restricted privilege rather than as root or admin. There is no indication of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.59% (46th percentile), and Siemens has released V4.0.1 which removes the exposure. Our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, i.e. a moderate-to-serious priority rather than an emergency.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to control the device by storing arbitrary files in the SFTP folder of the device. This could allow an attacker to cause a denial of service condition.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Default Credentials vulnerability could allow attackers to gain access using factory-default usernames and passwords.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SIMATIC CN 4100 devices running firmware versions before V4.0.1 expose server information in their responses, enabling an authenticated attacker with low-level privileges and network access to gain reconnaissance details that could increase the likelihood of targeted attacks. The vulnerability requires authentication (PR:L per CVSS 4.0 vector) and has low confidentiality impact, with an EPSS score of 0.28% (19th percentile) and no public exploit identified at time of analysis. Siemens has released firmware V4.0.1 to address the issue.
Inconsistent SNMP behavior in Siemens SIMATIC CN 4100 firmware versions below V4.0.1 lets an authenticated, highly privileged attacker who can reach the device's SNMP interface read sensitive data, producing a confidentiality-only impact with no effect on integrity or availability. The flaw manifests as unexpected service availability or unreliable configuration handling across SNMP protocol versions, meaning a protocol version that should not be exposed may become reachable, or configuration changes may not be applied as expected. No public exploit code has been identified at time of analysis, and exploitation is not confirmed as active; EPSS is low at 0.37% (28th percentile), so this moderate-severity issue (CVSS 4.0 base 6.9) sits toward the lower end of operational priority. Siemens has released firmware V4.0.1, which removes the affected condition.
Unauthenticated access to the USB port on Siemens SIMATIC CN 4100 devices (all firmware versions below V4.0.1) allows an attacker with direct physical access to trigger a device reboot, resulting in a denial-of-service condition. The CVSS 4.0 score of 5.1 reflects a strictly physical attack vector (AV:P) - the flaw cannot be reached remotely or across the network - and the impact is confined to availability, with no confidentiality, integrity, or code-execution consequences. The EPSS score is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the vendor has released firmware V4.0.1 to address the issue.
SIMATIC CN 4100 devices running firmware versions below V4.0.1 store sensitive credentials and keys in a hard-coded, recoverable form within the firmware image, allowing anyone who obtains and analyzes that image to extract secrets that apply across all devices of the same version. Siemens rates this 9.2 (Critical) under CVSS 4.0 with full High confidentiality, integrity and availability impact to the device itself; the practical barrier is that an attacker must first acquire a firmware image and have the capability to reverse it, which is why the vector carries AC:H despite being unauthenticated (PR:N/UI:N). No public exploit code or confirmed active exploitation has been identified at time of analysis (EPSS 0.38%, 30th percentile), and the issue is fixed in firmware V4.0.1.
Authenticated command injection in the REST API of Siemens SIMATIC CN 4100 firmware versions below V4.0.1 allows a user who already holds valid API credentials to pass unexpected argument values that are not properly validated, resulting in execution of arbitrary code with limited privileges on the controller. Exploitation requires both network reachability to the REST API endpoint and authenticated access (CVSS vector PR:L), so it is not an anonymous, drive-by attack, and the resulting code runs at restricted privilege rather than as root or admin. There is no indication of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.59% (46th percentile), and Siemens has released V4.0.1 which removes the exposure. Our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, i.e. a moderate-to-serious priority rather than an emergency.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to control the device by storing arbitrary files in the SFTP folder of the device. This could allow an attacker to cause a denial of service condition.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Default Credentials vulnerability could allow attackers to gain access using factory-default usernames and passwords.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.