Quick answers
- Is CVE-2026-22925 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-22925 being exploited in the wild.
- How severe is CVE-2026-22925?
- High severity, with a CVSS score of 7.5, published 12 May 2026.
- Which products and versions are affected?
- Siemens SIMATIC CN 4100 All versions < V5.0.
- Is there a fix for CVE-2026-22925?
- A patch was published on 2026-05-12: Siemens released version V5.0 to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-22925 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-22925?
- Check whether you run Siemens SIMATIC CN 4100 or Siemens Simatic Cn 4100 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The SIMATIC CN 4100 (versions prior to V5.0) is susceptible to a resource exhaustion vulnerability (CWE-770) triggered by a TCP SYN flood attack. An unauthenticated remote attacker can exploit this by sending a high volume of TCP SYN packets to the device, exhausting system resources and rendering the communication service unavailable. This results in a denial-of-service (DoS) condition. The vulnerability is addressed in firmware version V5.0. Security engineers are advised to update affected hardware and implement network-level protections to throttle or block suspicious TCP traffic.
Affected products
- Siemens SIMATIC CN 4100 All versions < V5.0
Timeline
- 2026-05-12: disclosed: Initial advisory publication by Siemens
- 2026-05-12: patched: Siemens released version V5.0 to address the issue