Siemens SIMATIC Vulnerability Exposes Configuration Data to Attack

EXECUTIVE SUMMARY:

An authentication vulnerability CVE-2025-40771 in Siemens SIMATIC ET 200SP communication processors allows unauthenticated remote attackers to access and potentially modify device configuration data, posing a severe risk to operational integrity and enabling lateral attacks across control networks; the issue affects all firmware versions prior to, has fixed firmware available, and should be mitigated immediately by applying the firmware update, restricting access to affected systems to trusted IP addresses only, isolating devices within protected networks, and enforcing strong access control, monitoring, and other industrial security best practices. The vulnerability has a CVSS score of 9.8.