# CVE-2025-40798: Siemens SIMATIC PCS neo out-of-bounds read in UMC

Source: https://junglewise.ai/threats/cve-2025-40798-siemens-simatic-pcs-neo-out-of-bounds-read-in-umc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-40798 · Severity: high · CVSS 7.5 · Published 2025-09-09

Siemens SIMATIC PCS neo, a control system used in industrial plants, and its User Management Component (UMC) are affected by a security flaw. An attacker could remotely crash the system, leading to a denial-of-service condition that disrupts plant operations and user management services. This could prevent authorized personnel from accessing or managing critical industrial infrastructure.

Technologies: [Siemens Simatic Pcs Neo](https://junglewise.ai/threats/technologies/simatic-pcs-neo), [Siemens User Management Component](https://junglewise.ai/threats/technologies/user-management-component). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-40798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-40798 being exploited in the wild.

**How severe is CVE-2025-40798?** High severity, with a CVSS score of 7.5, published 9 September 2025.

**Which products and versions are affected?** Siemens Simatic Pcs Neo V4.1 (All versions), V5.0 (All versions), V6.0 (All versions < V6.0 SP1 Update 1); Siemens User Management Component All versions < V2.15.1.3.

**Is there a fix for CVE-2025-40798?** A patch was published on 2026-06-09: Fix released for SIMATIC PCS neo V6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-40798 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-40798?** Check whether you run Siemens Simatic Pcs Neo or Siemens User Management Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the integrated User Management Component (UMC) used by Siemens SIMATIC PCS neo. The flaw is reachable over the network without authentication. By sending specially crafted packets to the affected component, an attacker can trigger an invalid memory read, leading to a crash of the service (Denial of Service). Siemens has released updates for UMC (V2.15.1.3) and SIMATIC PCS neo V6.0 (V6.0 SP1 Update 1) to address the issue. For versions where no fix is planned, Siemens recommends blocking TCP ports 4002 and 4004.

## Affected products

- Siemens SIMATIC PCS neo V4.1 (All versions), V5.0 (All versions), V6.0 (All versions < V6.0 SP1 Update 1)
- Siemens User Management Component (UMC) All versions < V2.15.1.3

## Timeline

- 2025-09-09: disclosed: Initial publication of advisory SSA-722410
- 2025-10-14: other: Advisory updated to include SIMATIC PCS neo V6.0 as affected
- 2026-06-09: patched: Fix released for SIMATIC PCS neo V6.0

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-722410.html](https://cert-portal.siemens.com/productcert/html/ssa-722410.html)

## Related threats

- [Siemens SIMATIC PCS neo out-of-bounds read in UMC](https://junglewise.ai/threats/cve-2025-40797-siemens-simatic-pcs-neo-out-of-bounds-read-in-umc)
- [Siemens SIMATIC PCS neo out-of-bounds read in UMC](https://junglewise.ai/threats/cve-2025-40796-siemens-simatic-pcs-neo-out-of-bounds-read-in-umc)
- [Siemens SIMATIC PCS neo stack overflow in User Management Component](https://junglewise.ai/threats/cve-2025-40795-siemens-simatic-pcs-neo-stack-overflow-in-user-management)
- [Siemens Engineering Platforms code execution via Windows Named Pipe](https://junglewise.ai/threats/cve-2024-54678-siemens-engineering-platforms-code-execution-via-windows-named)