Introduction
An unauthenticated network path into a process control communication node is the kind of finding that gets ICS security teams moving quickly. CVE-2026-22924 affects the Siemens SIMATIC CN 4100, a redundant multiprotocol communication node that bridges third-party systems into process control environments like SIMATIC PCS 7 and PCS neo. It carries a CVSS v3.1 base score of 9.1.
The SIMATIC CN 4100 consolidates multiple communication libraries into a single built-in interface, which reduces the communication load on industrial controllers. It sits at a critical point in process control architectures, so a disruption to this device can propagate across connected industrial systems. Siemens is a global leader in industrial automation, and the CN 4100 runs in environments where availability and integrity come first.
CVE-2026-22924 also has an unusual wrinkle. The same identifier covers an out-of-bounds read in Siemens NX, the company's product design software. We cover both below.
Technical Information
SIMATIC CN 4100: Missing Authentication (CWE-306)
The core issue in the SIMATIC CN 4100 is classified under CWE-306: Missing Authentication for Critical Function. The affected application does not properly restrict unauthenticated connections, which leaves the system open to resource exhaustion. An attacker with network access can exploit this without any privileges or user interaction.
The CVSS scoring breaks down as follows:
| Attribute | Value |
|---|---|
| Attack Vector | Network (AV:N) |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Integrity Impact | High |
| Availability Impact | High |
| CVSS v3.1 Score | 9.1 |
| CVSS v4.0 Score | 8.8 |
The attack flow is straightforward. An attacker on the network opens unauthenticated connections to the SIMATIC CN 4100. Because these connection paths have no authentication gate, the attacker can consume system resources at will until they are exhausted. That hits both availability (the device becomes unresponsive or degraded) and integrity (unauthorized actions become possible through the unauthenticated channel).
The Siemens advisory SSA-032379 also identifies a companion vulnerability, CVE-2026-22925, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). This second flaw enables TCP SYN packet floods against the device and carries a CVSS v3.1 score of 7.5, with high impact to availability. Two such flaws in the same advisory point to a pattern of insufficient connection handling in pre-V5.0 firmware.
| Vulnerability | CWE | CVSS v3.1 | Key Impact |
|---|---|---|---|
| CVE-2026-22924 | CWE-306 (Missing Authentication) | 9.1 | Integrity and Availability |
| CVE-2026-22925 | CWE-770 (Resource Allocation Without Limits) | 7.5 | Availability via SYN floods |
Siemens NX: Out-of-Bounds Read (CWE-125)
Separately, CISA ICS advisory ICSA-26-043-08 (a republication of Siemens ProductCERT advisory SSA-535115) assigns CVE-2026-22924 to Siemens NX, the product design software. Here the vulnerability is an out-of-bounds read (CWE-125) triggered while parsing specially crafted CGM (Computer Graphics Metafile) files. Exploitation requires user interaction. A victim must open a malicious CGM file, and successful exploitation could lead to code execution in the context of the current process. This instance carries a CVSS v3.1 base score of 7.8. Researcher Michael Heinzl is credited with the discovery.
One CVE identifier assigned to two distinct products with different root causes (CWE-306 vs. CWE-125) is unusual. Organizations should identify which product is present in their environment and apply the matching remediation.
Patch Information
Siemens has released patches for both affected products.
SIMATIC CN 4100: Update to V5.0
Siemens fixed CVE-2026-22924, along with over 150 other CVEs bundled in the same release, in SIMATIC CN 4100 V5.0. The fix was announced in Siemens Security Advisory SSA-032379, published on 2026-05-12 (V1.0), and the updated firmware is available from Siemens Industry Online Support. The fix adds authentication enforcement to the previously unauthenticated connection paths, which is the standard remediation for CWE-306. The new version restricts connections that were formerly open and so prevents unauthorized resource consumption.
Siemens NX: Update to V2512
Siemens resolved the out-of-bounds read in NX V2512, released in February 2026. The patch tightens bounds checking during CGM file parsing. Siemens documented the fix in advisory SSA-535115, and CISA republished it as ICSA-26-043-08.
Interim Mitigations
For environments where immediate patching is not feasible, Siemens advises the following:
- Protect network access to SIMATIC CN 4100 devices using appropriate mechanisms
- Configure the IT environment according to Siemens operational guidelines for Industrial Security
- Follow all security recommendations detailed in the specific product manuals
Organizations should inventory their environments for any SIMATIC CN 4100 devices running versions prior to V5.0 and schedule immediate maintenance windows for the firmware upgrade.
Affected Systems and Versions
SIMATIC CN 4100:
- All versions prior to V5.0 are affected
- Fixed in V5.0
Siemens NX:
- Versions prior to V2512 are affected (specific version range not detailed in the advisory)
- Fixed in V2512
Vendor Security History
Siemens runs a formal vulnerability handling and disclosure process through Siemens ProductCERT. ProductCERT investigates security issues and publishes Security Advisories with CVE references, CVSS scores, affected versions, and mitigation strategies. Bundling over 150 CVEs into the SIMATIC CN 4100 V5.0 release indicates a significant security hardening effort for this product line. The advisories also cross-reference CISA ICS advisories, which shows a mature security response capability.
