← console
voxell vciy

CVE-2025-40805

ROUTINE

Telemetry drift only. No threshold crossed and no authority ruling changed.

CVE record, CISA KEV and EPSS as of 2026-10-18.

CVEs like this one computed, by meaning

What to do now held facts and links

  1. No fix version is held. The CNA's first reference is the place to look: cert-portal.siemens.com
  2. Record your decision, dated and frozen with today's evidence: patch by a date · mitigated by a compensating control · deferred · accepted the risk · not affected
  3. Check your version against the ranges this record publishes.

What it is stated by the CNA

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate user.

weakness
CWE-639: Authorization Bypass Through User-Controlled Key
affected
Siemens Industrial Edge Cloud Device (IECD); Siemens Industrial Edge Device Kit - arm64 V1.10; Siemens Industrial Edge Device Kit - arm64 V1.11; Siemens Industrial Edge Device Kit - arm64 V1.12; Siemens Industrial Edge Device Kit - arm64 V1.13; Siemens Industrial Edge Device Kit - arm64 V1.14; Siemens Industrial Edge Device Kit - arm64 V1.15; Siemens Industrial Edge Device Kit - arm64 V1.16; Siemens Industrial Edge Device Kit - arm64 V1.17; Siemens Industrial Edge Device Kit - arm64 V1.18; Siemens Industrial Edge Device Kit - arm64 V1.19; Siemens Industrial Edge Device Kit - arm64 V1.20; Siemens Industrial Edge Device Kit - arm64 V1.21; Siemens Industrial Edge Device Kit - arm64 V1.22; Siemens Industrial Edge Device Kit - arm64 V1.23; Siemens Industrial Edge Device Kit - arm64 V1.24; Siemens Industrial Edge Device Kit - arm64 V1.25; Siemens Industrial Edge Device Kit - arm64 V1.5; Siemens Industrial Edge Device Kit - arm64 V1.6; Siemens Industrial Edge Device Kit - arm64 V1.7; Siemens Industrial Edge Device Kit - arm64 V1.8; Siemens Industrial Edge Device Kit - arm64 V1.9; Siemens Industrial Edge Device Kit - x86-64 V1.10; Siemens Industrial Edge Device Kit - x86-64 V1.11; Siemens Industrial Edge Device Kit - x86-64 V1.12; Siemens Industrial Edge Device Kit - x86-64 V1.13; Siemens Industrial Edge Device Kit - x86-64 V1.14; Siemens Industrial Edge Device Kit - x86-64 V1.15; Siemens Industrial Edge Device Kit - x86-64 V1.16; Siemens Industrial Edge Device Kit - x86-64 V1.17; Siemens Industrial Edge Device Kit - x86-64 V1.18; Siemens Industrial Edge Device Kit - x86-64 V1.19; Siemens Industrial Edge Device Kit - x86-64 V1.20; Siemens Industrial Edge Device Kit - x86-64 V1.21; Siemens Industrial Edge Device Kit - x86-64 V1.22; Siemens Industrial Edge Device Kit - x86-64 V1.23; Siemens Industrial Edge Device Kit - x86-64 V1.24; Siemens Industrial Edge Device Kit - x86-64 V1.25; Siemens Industrial Edge Device Kit - x86-64 V1.5; Siemens Industrial Edge Device Kit - x86-64 V1.6; Siemens Industrial Edge Device Kit - x86-64 V1.7; Siemens Industrial Edge Device Kit - x86-64 V1.8; Siemens Industrial Edge Device Kit - x86-64 V1.9; Siemens Industrial Edge Own Device (IEOD); Siemens Industrial Edge Virtual Device (IEVD); Siemens SCALANCE LPE9413; Siemens SCALANCE LPE9433; Siemens SIMATIC Automation Workstation 19"; Siemens SIMATIC Automation Workstation 24"; Siemens SIMATIC HMI MTP1000 Unified Comfort Panel; Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic; Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design; Siemens SIMATIC HMI MTP1000, Unified Comfort Panel neutral; Siemens SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit; Siemens SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio; Siemens SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP1200 Unified Comfort Panel; Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic; Siemens SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design; Siemens SIMATIC HMI MTP1200 Unified Comfort Panel neutral design; Siemens SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit; Siemens SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extensio; Siemens SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP1500 Unified Comfort Panel; Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic; Siemens SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design; Siemens SIMATIC HMI MTP1500 Unified Comfort Panel neutral design; Siemens SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit; Siemens SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extensio; Siemens SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP1900 Unified Comfort Panel; Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic; Siemens SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design; Siemens SIMATIC HMI MTP1900 Unified Comfort Panel neutral design; Siemens SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit; Siemens SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom); Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extensio; Siemens SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top); Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic; Siemens SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design; Siemens SIMATIC HMI MTP2200 Unified Comfort Panel; Siemens SIMATIC HMI MTP2200 Unified Comfort Panel neutral design; Siemens SIMATIC HMI MTP700 Unified Comfort Panel; Siemens SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design; Siemens SIMATIC HMI MTP700, Unified Comfort Panel neutral design; Siemens SIMATIC IOT2050; Siemens SIMATIC IPC BX-39A Industrial Edge Device; Siemens SIMATIC IPC BX-59A Industrial Edge Device; Siemens SIMATIC IPC127E Industrial Edge Device; Siemens SIMATIC IPC227E Industrial Edge Device; Siemens SIMATIC IPC227G Industrial Edge Device; Siemens SIMATIC IPC427E Industrial Edge Device; Siemens SIMATIC IPC847E Industrial Edge Device; Siemens SIPLUS HMI MTP1000 Unified Comfort; Siemens SIPLUS HMI MTP1200 Unified Comfort; Siemens SIPLUS HMI MTP700 Unified Comfort
versions
No affected-version range in held sources.
fixed in
No fix version in held sources.
severity
10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
assigned by
siemens
published
2026-01-13

check us cert-portal.siemens.com cert-portal.siemens.com

Exploit code held, dated

exploit code
None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

dateEPSSevent
13 Jan 20260.00127
14 Jan 20260.00169
19 Jan 20260.00201
7 Feb 20260.00199
14 Feb 20260.00217
18 Feb 20260.00079
22 Mar 20260.00084
15 May 20260.00088
11 Jun 20260.00062
12 Jun 20260.00081
15 Jun 20260.00601scoring model v2026.06.15
12 Aug 20260.00611
1 Sep 20260.00625
10 Sep 20260.00663
9 Oct 20260.00653

15 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

What would change this brief held, dated

CISA KEV
Not listed in the catalogue we hold. A listing changes this brief.
exploit probability
0.01 on 2026-10-09 (FIRST's EPSS, a probability and not evidence of exploitation). Next band line: 10% (0.10). Crossing a line changes this brief.
fix
No fix version is held. One published by the CNA or OSV changes this brief.

Watch this CVE What counts as a move

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2025-40805', '2026-10-31T23:59:59.999999Z', now());