CVE-2025-40805

Critical

Published: 13 January 2026

Published

13 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0008 24.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40805 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Siemens (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

AC-3 mandates enforcement of approved authorizations for logical access, directly addressing the failure to enforce user authentication on vulnerable API endpoints.

IA-2 Identification and Authentication (Organizational Users) good match

prevent

IA-2 requires identification and authentication of organizational users, preventing unauthenticated remote attackers from impersonating legitimate users.

AC-25 Reference Monitor good match

prevent

AC-25 implements a reference monitor mechanism to mediate and enforce access control policies, ensuring comprehensive authentication enforcement on all system interfaces including APIs.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Auth bypass on public API endpoints directly enables remote exploitation of a public-facing application without credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate…

user.

Deeper analysisAI

CVE-2025-40805, published on 2026-01-13, is a critical vulnerability (CVSS 10.0; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affecting specific devices, where certain API endpoints fail to properly enforce user authentication (CWE-639: Authorization Bypass Through User-Controlled Key). This flaw enables attackers to bypass authentication controls intended to verify legitimate users.

An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Exploitation requires the attacker to know the identity of a legitimate user, after which they can impersonate that user, potentially leading to high impacts on confidentiality, integrity, and availability in a scoped manner.

Siemens advisories SSA-001536 and SSA-014678, available at https://cert-portal.siemens.com/productcert/html/ssa-001536.html and https://cert-portal.siemens.com/productcert/html/ssa-014678.html, provide further details on affected products and recommended mitigations.