CVE-2023-49251 is a high severity flaw, scored 8.8, in Siemens SIMATIC CN 4100 before V2.7: an attacker can add their own credentials during the intermediate installation state and log in as root. Siemens says to update to V2.7 or later.
What's affected
The record says all versions of SIMATIC CN 4100 before V2.7 are affected. Siemens advisory SSA-777015 agrees: all versions before V2.7, with the remediation to update to V2.7 or later.
The scores need care. This CVE is rated 8.8 by both NVD and the advisory, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory as a whole carries a CVSS base score of 9.8, because it bundles several issues, including default credentials and an unauthenticated IP address change. Do not read the 9.8 at the top of the advisory as this CVE's score.
How to check if you're exposed
Read the software version of the SIMATIC CN 4100 from the device's management interface or from your asset records. Anything before V2.7 is affected.
Siemens also says to protect network access to the devices and to follow its operational guidelines for industrial security. As a check, confirm that the management interface is only reachable from a protected network segment.
What to do now
- Inventory SIMATIC CN 4100 devices and read the version on each.
- Update to V2.7 or later using the download that Siemens links from advisory SSA-777015.
- Protect network access to the devices as Siemens recommends, and place them inside a protected IT environment.
- Review the device accounts for credentials you do not recognize, because the issue lets an attacker add their own.
- Also address the other issues in the same advisory, which the same update covers.
Why it matters
The record classifies the weakness as CWE-639, authorization bypass through user-controlled key. In plain terms, a transitional state of the product, the intermediate installation, accepts changes that should only be possible for a trusted administrator, and that state can persist after setup is finished.
The result is persistent root access that survives the device being fully set up. That is why an update matters even for devices that look correctly configured. Industrial communication nodes sit between process control systems and other networks, so a root takeover has consequences beyond the single box. KEV status is false for this CVE.
The attacker needs low privileges, shown as PR:L in the vector, which is the reason for 8.8 rather than the 9.8 that the advisory carries overall.
Quick check
The advisory says 9.8 but the CVE says 8.8. Which is right?
Both. The advisory covers several vulnerabilities and gives the highest base score. CVE-2023-49251 itself is scored 8.8.
Sources
Siemens ProductCERT advisory SSA-777015
Last reviewed: 19 October 2026.
