External risk intelligence

SIMATIC PCS neo User Management Remote Code Execution and Denial of Service.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-40795

The affected products are industrial control system software and user management components. While these are network-reachable, they are typically deployed within restricted operational technology or internal enterprise environments, not exposed to the public internet in normal deployments.

Buffer Overflow

Siemens Simatic Pcs Neo

4.15.0before 2.15.1.3

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Siemens' SIMATIC PCS neo and User Management Component, potentially allowing unauthenticated attackers to execute code or disrupt services remotely. This issue resides within the integrated User Management Component.

Remote attackers could run code or cause disruptions.
It impacts industrial control and user management systems.
Confirm relevance and assess exposure to industrial systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted network request to an unauthenticated system running the vulnerable User Management Component. This could lead to the attacker executing arbitrary code or causing a denial of service.

Entry condition: Network access, no authentication required.
Trigger point: Vulnerable User Management Component.
Resulting risk: Code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

The integrated User Management Component within SIMATIC PCS neo could be at risk from an unauthenticated remote attacker due to a stack-based buffer overflow. This could lead to arbitrary code execution or a denial-of-service condition when the system is accessible over a network.

System access and control could be compromised.
Network-accessible systems may be targeted.
Service disruption or unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical vulnerability in SIMATIC PCS neo and its User Management Component impacts industrial control systems and user authentication. Ownership will likely fall to the teams managing these operational technology (OT) environments, potentially involving collaboration with IT infrastructure and security teams. The immediate first step is to inventory all instances of the affected software, confirm their network exposure and criticality to operations, and identify the specific asset owners responsible for each deployment. This information will then inform a prioritized remediation plan, considering vendor coordination and maintenance windows.

Ownership: OT and security teams manage affected systems.
Verify: Deployment reachability and operational criticality.
Action: Plan coordinated vendor-supported remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SIMATIC PCS neo and the User Management Component?

SIMATIC PCS neo is a process control system used for managing industrial automation. It relies on the integrated User Management Component (UMC) to handle authentication and identity tasks across the software. These components are essential for maintaining secure access to industrial environments, though they operate as software services that facilitate central administration of user accounts and permissions.

What is the stack-based buffer overflow in CVE-2025-40795?

This vulnerability, classified as CWE-121, occurs when the software tries to write more data to a memory buffer than it can hold. Because the UMC component does not properly check the size of incoming data, an attacker can overwrite adjacent memory. In the context of CVE-2025-40795, this memory corruption can allow an attacker to run their own commands on the system or crash the service, leading to a denial of service.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically formatted network request to a system running the affected UMC software. The vulnerability is reached through the network stack directly; it does not require the attacker to have a valid user account, provide credentials, or interact with the system's login interface. Simply having network connectivity to the vulnerable service is enough to initiate the attack sequence.

Is my system at risk if it is not on the internet?

While CVE-2025-40795 is reachable over a network, Halo Surface Signal notes that products like SIMATIC PCS neo are typically housed within restricted operational technology or internal networks. If your system is truly isolated from both the public internet and untrusted internal segments, the risk is reduced. However, internal exposure still poses a threat if an attacker gains a foothold elsewhere in your private network infrastructure.

What should I do if I run these Siemens products?

Your first step is to inventory all deployments of SIMATIC PCS neo and the standalone User Management Component within your environment. Identify which systems are reachable over the network and assess their operational importance. Coordinate with your OT and security teams to plan for vendor-supported updates, ensuring you schedule these changes during planned maintenance windows to avoid unintended production disruptions.

References

cert-portal.siemens.com/productcert/html/ssa-722410.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.