Vulnerability Details CVE-2025-40566
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 17.4%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2025-40566
-
cpe:2.3:a:siemens:simatic_pcs_neo:-
-
cpe:2.3:a:siemens:simatic_pcs_neo:3.0
-
cpe:2.3:a:siemens:simatic_pcs_neo:3.1
-
cpe:2.3:a:siemens:simatic_pcs_neo:4.0
-
cpe:2.3:a:siemens:simatic_pcs_neo:4.1
-
cpe:2.3:a:siemens:simatic_pcs_neo:5.0