PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-40566 Siemens CVE debrief

CVE-2025-40566 is a high-severity Siemens SIMATIC PCS neo vulnerability in which user sessions are not correctly invalidated on logout. If an attacker has already obtained a valid session token by other means, they may be able to reuse that session after the legitimate user logs out. Siemens and CISA published the advisory on 2025-05-13, and vendor updates are available for the affected product lines.

Vendor
Siemens
Product
SIMATIC PCS neo V4.1
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-13
Original CVE updated
2025-05-13
Advisory published
2025-05-13
Advisory updated
2025-05-13

Who should care

Organizations running Siemens SIMATIC PCS neo V4.1 or V5.0, especially industrial and OT environments where authenticated user sessions protect operational interfaces. Security teams, OT administrators, and identity/access management owners should prioritize review and remediation.

Technical summary

The issue is a session invalidation failure: logout does not reliably revoke an active user session. The advisory states that a remote unauthenticated attacker who has obtained the session token by other means could continue to use a legitimate user's session even after logout. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with a CVSS score of 8.8 (High). Affected products listed in the source are Siemens SIMATIC PCS neo V4.1 and V5.0.

Defensive priority

High. The issue is publicly disclosed, rated High, affects OT software, and has vendor-provided fixes. Even though token theft is a prerequisite, the impact of session reuse after logout can be significant in environments where sessions grant operational access.

Recommended defensive actions

  • Update Siemens SIMATIC PCS neo V4.1 to Update 3 or later.
  • Update Siemens SIMATIC PCS neo V5.0 to Update 1 or later.
  • Verify that logout and session timeout behavior works as expected in your environment after upgrading.
  • Review access controls and session-handling practices for OT web applications and operator interfaces.
  • Monitor for suspicious session reuse or access that persists beyond expected logout events.

Evidence notes

All core statements are taken from the supplied CISA CSAF source item and its listed Siemens references. The source identifies the affected products, the logout/session invalidation weakness, the potential for session reuse after logout, the CVSS score/vector, and the vendor remediation versions. The timeline fields supplied with the corpus show publication and modification on 2025-05-13. No KEV listing or ransomware association was provided in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-40566 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-40566

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-40566 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-40566

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-135-12.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-339086.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-339086.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-12

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.