CVE-2025-40818: siemens sinema_remote_connect_server

Vulnerability summary

CVE-2025-40818 is a low (CVSS 3.3) vulnerability in siemens sinema_remote_connect_server. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.8% of scored vulnerabilities.

Timeline

1. 09-12-2025
   PublishedVulnerability first disclosed.
2. 09-12-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.