Introduction
Remote code execution in an industrial control system can disrupt manufacturing, energy, and other critical infrastructure operations. CVE-2025-40795 exposes Siemens SIMATIC PCS neo installations to unauthenticated attacks that could halt production or compromise safety-critical processes.
About Siemens and SIMATIC PCS neo: Siemens is a major global supplier of industrial automation and digitalization technology, and SIMATIC PCS neo is its flagship distributed control system for the process industries. These systems run in thousands of manufacturing plants, power generation sites, and critical infrastructure facilities around the world. The User Management Component (UMC) handles authentication and authorization across Siemens' industrial product lines, so its security matters to every operational technology environment built on those products.
Technical Information
CVE-2025-40795 is a stack-based buffer overflow in the integrated User Management Component (UMC) of SIMATIC PCS neo. It comes from improper bounds checking when UMC handles network requests. An unauthenticated remote attacker can send crafted data to the UMC service and make the application write beyond the bounds of a stack-allocated buffer. The overflow can overwrite adjacent memory, including function return addresses, which can lead to arbitrary code execution or a denial of service.
Key technical points:
- The flaw is present in all versions of SIMATIC PCS neo V4.1 and V5.0, and in UMC versions before V2.15.1.3.
- UMC is usually reachable over TCP ports 4002 and 4004.
- Exploitation requires no authentication, which raises the risk considerably for exposed systems.
- The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow).
No public code snippets or proof of concept were available at the time of writing.
Affected Systems and Versions
- SIMATIC PCS neo V4.1 (all versions)
- SIMATIC PCS neo V5.0 (all versions)
- User Management Component (UMC) versions before V2.15.1.3
Any deployment of these products running UMC before V2.15.1.3 is vulnerable. Every configuration where the UMC service is reachable over the network is part of the attack surface, and the exposure is worst when TCP ports 4002 or 4004 are open to untrusted networks.
Vendor Security History
UMC has had multiple critical vulnerabilities across 2024 and 2025. Two examples:
- CVE-2024-33698: Heap-based buffer overflow in UMC, CVSS 9.8
- CVE-2024-49775: Heap-based buffer overflow in UMC, CVSS 9.8
Siemens generally issues advisories and patches promptly. Still, the repeated memory safety bugs in UMC suggest the component has ongoing problems with secure development.
