CVE-2026-22924: Siemens SIMATIC CN 4100 Missing Authentication (CWE-306)
Siemens SIMATIC CN 4100 versions before V5.0 are affected by CVE-2026-22924, in which the application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion. The CNA-provided CVSS 3.1 base score is 9.1, and the record references a Siemens advisory with mitigation information. No confirmed exploitation appears in the sources consulted.
Overview
Siemens published advisory SSA-032379 for SIMATIC CN 4100, tracked as CVE-2026-22924 and classified under CWE-306 (Missing Authentication for Critical Function). According to the record, the application does not properly restrict unauthenticated connections and can be affected by resource exhaustion.
Impact
- The CNA-provided CVSS 3.1 base score is 9.1 (critical), with high integrity and availability impact and no confidentiality impact in the vector.
- The same CNA also lists a CVSS base score of 8.8 under a newer CVSS version.
- SSVC data in the record rates technical impact as partial and automatable as yes.
The description states that an attacker could disrupt normal operations or perform unauthorized actions, potentially affecting availability and integrity.
Affected products and versions
- Siemens SIMATIC CN 4100 before V5.0.
- Siemens Simatic Cn 4100 Firmware before 5.0.
The record uses V5.0 as the boundary version. Whether V5.0 and later releases are unaffected is an inference from the affected range and should be confirmed in the Siemens advisory SSA-032379.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.003 (percentile 0.21519) and an SSVC exploitation value of none.
Remediation and mitigation
- Review the Siemens advisory SSA-032379, which the record lists as a mitigation source.
- Plan an update of SIMATIC CN 4100 to V5.0 or later where operationally feasible, as the affected range implies. The record does not provide detailed upgrade steps.
- Limit network reachability to the device so that only required and trusted hosts can connect, and keep it within an segmented industrial network design.
Detection guidance
- Monitor for connections to the device from unknown or untrusted sources.
- Track unusual resource consumption, restarts or service unavailability on the device as possible signs of disruption.
Limitations of the available information
The record does not include an explicit fixed version, a detailed vendor description beyond the summary text, or technical details about the condition. The English title was absent in the source and was written for this portal. Exploitability in specific deployments is unknown.
Frequently asked questions
What is CVE-2026-22924?
It is a Siemens-reported vulnerability in SIMATIC CN 4100 where the application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion, classified as CWE-306.
Which versions are affected?
The record lists SIMATIC CN 4100 before V5.0 and Simatic Cn 4100 Firmware before 5.0. Confirm the exact boundaries in the Siemens advisory.
Is this vulnerability being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Its EPSS probability is 0.003 as recorded.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.