# Siemens SINUMERIK VNC authentication bypass on adjacent network

Published: 2025-08-14 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/44f5db02-dc79-5d08-8be9-6565e797c3e6/siemens-sinumerik-vnc-authentication-bypass-on-adjacent-network

> Authentication bypass in Siemens SINUMERIK VNC service allows adjacent network attackers unauthorized access; no active exploitation reported.

Siemens SINUMERIK industrial control systems contain an authentication bypass vulnerability in the VNC access service that improperly validates credentials, allowing attackers on an adjacent network to gain unauthorized remote access with low attack complexity. The vulnerability affects multiple SINUMERIK product lines including 828D PPU, 840D sl, MC, and ONE series across multiple versions. Successful exploitation could compromise confidentiality, integrity, or availability of affected systems. CISA reports no known public exploitation as of the advisory date, and the vulnerability is not remotely exploitable—requiring adjacent network access. Siemens has released patches for all affected product versions and recommends immediate updating along with network segmentation and VNC port closure via HMI settings.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40743

## Detection guidance (public sample)

### Non-VNC-Client Process Connecting to VNC Port on Internal Host

ATT&CK: T1133

Detects a process that is not a known VNC client opening an outbound connection to a VNC port (5900-5903) on an internal address. This can indicate scripted or exploit-driven access to adjacent VNC services such as the SINUMERIK HMI VNC authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-VNC-Client Process Connecting to VNC Port on Internal Host
description: Detects a process that is not a known VNC client opening an outbound
  connection to a VNC port (5900-5903) on an RFC1918 address. Can indicate scripted
  or exploit-driven access to adjacent VNC services such as the SINUMERIK HMI VNC
  authentication bypass. The report is an advisory with no public exploitation, so
  this is a hunting-grade network behaviour rule.
tags:
- attack.initial-access
- attack.persistence
- attack.t1133
- attack.t1078
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
    - 5900
    - 5901
    - 5902
    - 5903
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  filter_vnc_clients:
    Image|endswith:
    - \vncviewer.exe
    - \tvnviewer.exe
    - \vncviewer64.exe
    - \VNC-Viewer.exe
    - \ultravnc_viewer.exe
  condition: selection and not filter_vnc_clients
falsepositives:
- Engineering workstations using a less common or portable VNC client to reach HMI
  or PLC panels
- Network or asset scanners probing VNC ports during authorised vulnerability assessments
level: medium
id: ce12b80b-83ac-5e57-a2d8-e61c0029920d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-19
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-19

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/44f5db02-dc79-5d08-8be9-6565e797c3e6/siemens-sinumerik-vnc-authentication-bypass-on-adjacent-network.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup