CVE-2025-40804: Critical Flaw in Siemens SIVaaS Exposes Network Share Without Authentication

On 10 September 2025, Siemens disclosed a critical security vulnerability (CVE-2025-40804) in its SIMATIC Virtualization as a Service (SIVaaS) platform, rated CVSS 9.1. The flaw exposes a network share without authentication, potentially allowing attackers to access or alter sensitive data. According to Siemens, “SIMATIC Virtualization as a Service (SIVaaS) is affected by a vulnerability which exposes a network share without any authentication.

This could allow an attacker to access or alter sensitive data without proper authorization.” The advisory classifies the issue under CWE-732: Incorrect Permission Assignment for Critical Resource, with a network attack vector and no privileges or user interaction required, enabling remote exploitation by an unauthenticated attacker. The advisory also states that all versions are affected and lists specific MLFBs impacted, including 9LA1110-6SV40-5DA3 through 9LA1110-6SV40-5XA3.

Siemens urges affected customers to contact technical support to fix the vulnerability and highlights general industrial security guidelines to protect network access and operate devices within a protected IT environment.