Introduction
A misconfiguration in Siemens SIMATIC Virtualization as a Service (SIVaaS) lets any user on the network access or modify sensitive industrial data and configuration files in critical infrastructure environments. The issue affects every SIVaaS deployment and has a critical CVSS score of 9.1.
About SIVaaS and Siemens: Siemens is a major global supplier of industrial automation and digitalization products, and its SIMATIC product line is widely used in manufacturing, energy, and transportation. SIVaaS is Siemens' virtualization platform, built to simplify deploying and managing industrial automation systems. It supports applications such as PCS 7, WinCC, and TIA Portal. Because SIVaaS is widely adopted in operational technology environments, a vulnerability in it hits industrial organizations especially hard.
Technical information
CVE-2025-40804 comes from network shares that all versions of SIVaaS expose without any authentication requirement. Any user with network access can enumerate and open the shared directories, whatever their authorization status. These shares may hold sensitive configuration files, operational data, project backups, or other critical resources.
The vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). The root cause is a misconfiguration in the platform's share permissions, which do not restrict access to authenticated or authorized users. Attackers can connect to the shares over standard protocols such as SMB or NFS. Where write permissions are present, they could also alter or corrupt files, inject malicious content, or disrupt operations.
No vulnerable code snippets or proof-of-concept details are publicly available for this issue. The vendor advisory confirms the exposure but gives no implementation specifics.
Affected systems and versions
- Product: Siemens SIMATIC Virtualization as a Service (SIVaaS)
- Affected Versions: All versions (no exceptions or version ranges specified)
- Vulnerable Configurations: Any deployment of SIVaaS with default or misconfigured network share permissions
Vendor security history
Siemens has fixed earlier vulnerabilities in its industrial automation portfolio, including authentication bypasses and access control misconfigurations in SIMATIC and related products. The company runs a dedicated ProductCERT and has improved its vulnerability response processes. Even so, the recurring access control issues indicate that securing complex operational technology platforms remains a persistent problem.
