Siemens UMC buffer overflow and DoS flaws unauthenticated
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated remote code execution and denial-of-service in Siemens User Management Component affects SIMATIC PCS neo globally.
Siemens User Management Component (UMC), integrated into SIMATIC PCS neo V4.1 and V5.0, contains four remotely exploitable vulnerabilities affecting critical manufacturing infrastructure worldwide. CVE-2025-40795 is a stack-based buffer overflow (CWE-121) in the UMC that allows unauthenticated remote attackers to execute arbitrary code or cause denial-of-service with CVSS v3.1 9.8 and v4 9.3 scores. Three additional out-of-bounds read vulnerabilities (CVE-2025-40796, CVE-2025-40797, CVE-2025-40798, all CWE-125) allow unauthenticated attackers to cause denial-of-service conditions with CVSS scores of 7.5 (v3.1) and 8.7 (v4). All vulnerabilities require no authentication, no user interaction, and have low attack complexity, making them exploitable over the network via TCP ports 4002 and 4004.
Siemens has released UMC version 2.15.1.3 or later as a fix, but no patches are currently planned for SIMATIC PCS neo V4.1 and V5.0. CISA reports no known public exploitation of these vulnerabilities at this time. Defenders should prioritize updating UMC to 2.15.1.3+, isolate affected systems from internet-facing networks, and where fixes are unavailable, implement firewall rules to block TCP ports 4002 and 4004. Network segmentation and remote access controls via VPN are essential given the critical nature of the manufacturing sector impact.
Mentioned in this report
Detection guidance
Inbound Connection from Non-Private Address to Siemens UMC Ports 4002/4004
Detects inbound connections from public IP space to TCP 4002/4004, the ports exposed by Siemens UMC (CVE-2025-40795 to 40798). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Connection from Non-Private Address to Siemens UMC Ports 4002/4004
id: bf00be1b-dd8e-5843-8fe0-7c79fedbc0f1
status: experimental
description: Detects inbound network connections from non-RFC1918/non-local source
addresses to TCP ports 4002 or 4004 on a Windows host. These are the ports used
by Siemens User Management Component (UMC) and reachable by unauthenticated attackers
exploiting the stack overflow and out-of-bounds read flaws (CVE-2025-40795 to CVE-2025-40798).
Intended for hosts running UMC / SIMATIC PCS neo; scope accordingly.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-07
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'false'
DestinationPort:
- 4002
- 4004
filter_private:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- fe80::/10
- fc00::/7
- ::1/128
condition: selection and not filter_private
falsepositives:
- Legitimate remote engineering or operator stations reaching UMC through NAT or a
public-addressed corporate range
- Authorised external vulnerability scanners probing industrial hosts
level: medium
author: Vorant
Firewall Traffic from Public Source to Siemens UMC Ports 4002/4004
Detects firewall-logged traffic from non-private sources to TCP 4002/4004, indicating internet exposure or exploitation attempts against Siemens UMC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firewall Traffic from Public Source to Siemens UMC Ports 4002/4004
id: 9a45b2a1-b847-5da7-82bf-5350bea785ca
status: experimental
description: Detects firewall log entries where a non-private source address targets
TCP port 4002 or 4004. Siemens UMC in SIMATIC PCS neo exposes these ports and is
vulnerable to unauthenticated stack-based buffer overflow and out-of-bounds read
DoS (CVE-2025-40795 to CVE-2025-40798). Repeated hits from one source within a short
period raise confidence; apply thresholding in the SIEM.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-07
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
logsource:
category: firewall
detection:
selection:
dst_port:
- 4002
- 4004
filter_private:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private
falsepositives:
- Authorised vendor or integrator remote access to the OT network from public addresses
- Internet-wide scanners hitting unrelated services that happen to use ports 4002
or 4004
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-07
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs