CVE-2025-40566: siemens simatic_pcs_neo Insufficient Session Expiration

Vulnerability summary

CVE-2025-40566 is a critical (CVSS 9.8) Insufficient Session Expiration vulnerability in siemens simatic_pcs_neo. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities.

Timeline

1. 13-05-2025
   PublishedVulnerability first disclosed.
2. 13-05-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."