CVE-2025-40805

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate user.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
SiemensIndustrial Edge Cloud Device (IECD)< V1.24.2
SiemensIndustrial Edge Device Kit - arm64 V1.10< *
SiemensIndustrial Edge Device Kit - arm64 V1.11< *
SiemensIndustrial Edge Device Kit - arm64 V1.12< *
SiemensIndustrial Edge Device Kit - arm64 V1.13< *
SiemensIndustrial Edge Device Kit - arm64 V1.14< *
SiemensIndustrial Edge Device Kit - arm64 V1.15< *
SiemensIndustrial Edge Device Kit - arm64 V1.16< *
SiemensIndustrial Edge Device Kit - arm64 V1.17< *
SiemensIndustrial Edge Device Kit - arm64 V1.18< *
SiemensIndustrial Edge Device Kit - arm64 V1.19< *
SiemensIndustrial Edge Device Kit - arm64 V1.20< *
SiemensIndustrial Edge Device Kit - arm64 V1.21< *
SiemensIndustrial Edge Device Kit - arm64 V1.22< *
SiemensIndustrial Edge Device Kit - arm64 V1.23< *
SiemensIndustrial Edge Device Kit - arm64 V1.24< V1.24.2
SiemensIndustrial Edge Device Kit - arm64 V1.25< V1.25.1
SiemensIndustrial Edge Device Kit - arm64 V1.5< *
SiemensIndustrial Edge Device Kit - arm64 V1.6< *
SiemensIndustrial Edge Device Kit - arm64 V1.7< *
SiemensIndustrial Edge Device Kit - arm64 V1.8< *
SiemensIndustrial Edge Device Kit - arm64 V1.9< *
SiemensIndustrial Edge Device Kit - x86-64 V1.10< *
SiemensIndustrial Edge Device Kit - x86-64 V1.11< *
SiemensIndustrial Edge Device Kit - x86-64 V1.12< *
SiemensIndustrial Edge Device Kit - x86-64 V1.13< *
SiemensIndustrial Edge Device Kit - x86-64 V1.14< *
SiemensIndustrial Edge Device Kit - x86-64 V1.15< *
SiemensIndustrial Edge Device Kit - x86-64 V1.16< *
SiemensIndustrial Edge Device Kit - x86-64 V1.17< *
SiemensIndustrial Edge Device Kit - x86-64 V1.18< *
SiemensIndustrial Edge Device Kit - x86-64 V1.19< *
SiemensIndustrial Edge Device Kit - x86-64 V1.20< *
SiemensIndustrial Edge Device Kit - x86-64 V1.21< *
SiemensIndustrial Edge Device Kit - x86-64 V1.22< *
SiemensIndustrial Edge Device Kit - x86-64 V1.23< *
SiemensIndustrial Edge Device Kit - x86-64 V1.24< V1.24.2
SiemensIndustrial Edge Device Kit - x86-64 V1.25< V1.25.1
SiemensIndustrial Edge Device Kit - x86-64 V1.5< *
SiemensIndustrial Edge Device Kit - x86-64 V1.6< *
SiemensIndustrial Edge Device Kit - x86-64 V1.7< *
SiemensIndustrial Edge Device Kit - x86-64 V1.8< *
SiemensIndustrial Edge Device Kit - x86-64 V1.9< *
SiemensIndustrial Edge Own Device (IEOD)< V1.24.2
SiemensIndustrial Edge Virtual Device (IEVD)< V1.24.2
SiemensSCALANCE LPE9413< V2.2
SiemensSCALANCE LPE9433< V2.2
SiemensSIMATIC Automation Workstation 19"< V1.3
SiemensSIMATIC Automation Workstation 24"< V1.3
SiemensSIMATIC HMI MTP1000 Unified Comfort Panel< V21

References

Timeline

Published
Jan 13, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-408065.3A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeratioCVE-2025-408075.4A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay CVE-2025-408086.1A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CCVE-2025-408097.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update CVE-2025-40814.8Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute aCVE-2025-408107.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update CVE-2025-408117.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update CVE-2025-408127.8A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update CVE-2025-408157.2A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (CVE-2025-408167.6A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (CVE-2025-408176.5A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (CVE-2025-408183.3A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS
CVE-2025-40805: Critical severity, CVSS 10.0 | Vulnix