CVE-2025-40804 - A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions) · CoreCVE

Back Back to CVE browser

CRITICAL

A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions)

Published Sep 9, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 0.40%

Description

A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization.

Affected products

Vendor Siemens Product SIMATIC Virtualization as a Service (SIVaaS) Default
unknown
Affected
- 0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Siemens	SIMATIC Virtualization as a Service (SIVaaS)	unknown	Affected 0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (2)

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/html/ssa-534283.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27234		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner siemens

Published Sep 9, 2025

Updated Sep 9, 2025

Reserved Apr 16, 2025

Link CVE-2025-40804

CISA Vulnrichment

Updated Sep 9, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-40804

Red Hat

No data

ENISA EUVD

Assigner siemens

Published Sep 9, 2025

Updated Sep 9, 2025

Link EUVD-2025-27234

GitHub

No data