CVE-2025-40805
Published: 13 January 2026
Summary
CVE-2025-40805 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Siemens (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-40805, published on 2026-01-13, is a critical vulnerability (CVSS 10.0; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affecting specific devices, where certain API endpoints fail to properly enforce user authentication (CWE-639: Authorization Bypass Through User-Controlled Key). This flaw enables attackers to bypass authentication controls intended to verify legitimate users.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Exploitation requires the attacker to know the identity of a legitimate user, after which they can impersonate that user, potentially leading to high impacts on confidentiality, integrity, and availability in a scoped manner.
Siemens advisories SSA-001536 and SSA-014678, available at https://cert-portal.siemens.com/productcert/html/ssa-001536.html and https://cert-portal.siemens.com/productcert/html/ssa-014678.html, provide further details on affected products and recommended mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2362
Vulnerability details
Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a legitimate…
more
user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Auth bypass on public API endpoints directly enables remote exploitation of a public-facing application without credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved authorizations for logical access, directly addressing the failure to enforce user authentication on vulnerable API endpoints.
IA-2 requires identification and authentication of organizational users, preventing unauthenticated remote attackers from impersonating legitimate users.
AC-25 implements a reference monitor mechanism to mediate and enforce access control policies, ensuring comprehensive authentication enforcement on all system interfaces including APIs.