CVE-2025-40566 is a high severity flaw (CVSS 8.8) in Siemens SIMATIC PCS neo, a distributed control system. Sessions are not invalidated at logout. Update V4.1 to V4.1 Update 3 or later, and V5.0 to V5.0 Update 1 or later, as Siemens advises.
What's affected
Siemens advisory SSA-339086, published 13 May 2025, lists two product lines:
- SIMATIC PCS neo V4.1, all versions before V4.1 Update 3. Update to V4.1 Update 3 or later.
- SIMATIC PCS neo V5.0, all versions before V5.0 Update 1. Update to V5.0 Update 1 or later.
Siemens describes SIMATIC PCS neo as a distributed control system. The advisory gives a CVSS v3.1 base score of 8.8 and a CVSS v4.0 score of 8.7.
The problem is that the affected products do not correctly invalidate user sessions when a user logs out. An attacker who has obtained the session token by other means could reuse the legitimate user's session even after logout. The attacker does not need to be logged in, but needs the token, so the flaw adds to other weaknesses rather than standing alone.
How to check if you're exposed
There is no package manager command for this product. Use the product itself.
- Open the version information in your PCS neo installation and note the release and update level.
- Compare it with the table above. Anything on V4.1 below Update 3, or V5.0 below Update 1, is affected.
- Check the Siemens advisory SSA-339086 for the download links to the updates, and confirm them through your Siemens support channel.
- Review who can reach the web or client interfaces of the system, and from which networks.
The session token can be exposed in ways outside the product, such as shared workstations, proxy logs or unencrypted network paths. Include those in your review.
What to do now
- Plan the update for each affected system. Test it on a non production system if you have one, as is normal for process control software.
- Install V4.1 Update 3 or later, or V5.0 Update 1 or later.
- Until you have updated, protect network access to the system with segmentation and firewall rules. Siemens recommends operating in a protected IT environment and points to its operational guidelines for industrial security.
- Make sure sessions travel only over encrypted channels, and that operators use trusted workstations.
- After the update, restart sessions so that old tokens do not remain in use.
- Record the change in your asset inventory.
Why it matters
The weakness is insufficient session expiration, CWE-613. Logging out should end the session on the server. If the server keeps accepting the token afterwards, logout gives a false sense of safety. Anyone who captured the token earlier can keep using it.
The score of 8.8 is high because of what a session in a control system can do. The vector lists high impact on confidentiality, integrity and availability, and notes that some user interaction is needed. In an industrial setting that means plant data and operations, not only a web account.
This CVE is not on the CISA Known Exploited Vulnerabilities list. For operational technology, the practical lesson is to treat the software update and the network design as one job. Our free in-browser dependency scan and the Gold directory help you track the software side of an inventory, and the demo below shows how a vulnerability programme can keep one list across many systems.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to be attacked?
The advisory describes a remote unauthenticated attacker, but one who has already obtained a valid session token by other means. Protecting tokens and updating both matter.
Sources
Last reviewed: 18 October 2026.
