CVE-2025-40938 is a high severity flaw (CVSS 8.1) in the Siemens SIMATIC CN 4100 communication node. The device stores sensitive information in its firmware, which an attacker could misuse. Siemens fixed it in V4.0.1, so update every unit running an earlier version.
What's affected
Siemens advisory SSA-416652 lists SIMATIC CN 4100 with all versions before V4.0.1 as affected. The remediation is to update to V4.0.1 or a later version. The NVD record lists the same product and its firmware.
The same advisory covers four other CVEs for this product: CVE-2025-40937, CVE-2025-40939, CVE-2025-40940 and CVE-2025-40941. They share the same affected range and the same fix, so one update closes the whole set.
Siemens describes the SIMATIC CN 4100 as a communication node that connects third party systems in process control setups. That context matters, because these devices often sit on industrial networks that people assume are closed off.
How to check if you're exposed
Check the firmware version in the device management interface or in your asset inventory, and compare it with V4.0.1. Anything older is in scope. I could not confirm a command line check from the advisory, so use the steps in the Siemens advisory and the product manual.
Next, work out who can reach each device. The CVSS vector scores this issue as network reachable, with high attack complexity, no privileges and no user interaction. A device that only a handful of engineering hosts can reach is a much smaller problem than one on a flat network.
If you track devices in a spreadsheet, add a column for firmware version and sort by it. Units you cannot identify are the ones to chase first.
What to do now
- List every SIMATIC CN 4100 and record its firmware version.
- Download V4.0.1 or later from the Siemens support page linked in the advisory and schedule the update.
- Until the update is done, restrict network access to the devices with firewall rules and segmentation, as Siemens recommends.
- Follow the Siemens operational guidelines for industrial security when you place the devices in your network.
- Read the full advisory for the other four CVEs so the maintenance window covers them too.
Why it matters
The advisory classifies this issue as CWE-798, use of hard-coded credentials. When a secret ships inside firmware, every unit of that product carries the same secret. Anyone who obtains the firmware image, or one device, can pull it out and try it against all the others.
That is why the impact line is so broad. Siemens notes the exposed information could affect confidentiality, integrity and availability. It is not listed as exploited in the wild; the record is not on the CISA Known Exploited Vulnerabilities list.
The wider lesson is about inventory. You cannot patch what you cannot find, and embedded devices rarely show up in the same tools as servers.
Try it yourself
An inventory is the first step for any firmware or software advisory. This short demo shows how a dependency inventory is built and queried.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-40938?
Siemens lists V4.0.1 or later as the fix for SIMATIC CN 4100. All earlier versions are affected.
Is CVE-2025-40938 exploited in the wild?
Not according to the record or the Siemens advisory I read. It is not on the CISA KEV list. Still, hard-coded secrets are easy to reuse once they are known, so patch on a normal industrial schedule rather than leaving it.
Sources
Last reviewed: 18 October 2026.
