Siemens ProductCERT Patch Day — December 2025

Tuesday, 9 December 2025

Vulnerabilities: 21
Critical: 0
High: 11
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

All vulnerabilities 21

High11 Show

High 8.8
CVE-2024-56835 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al…
High 8.3
CVE-2025-40937 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST …
High 8.1
CVE-2025-40801 A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All v…
High 8.1
CVE-2025-40938 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could al…
High 7.5
CVE-2024-56836 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al…
High 7.5
CVE-2025-40820 Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unau…
High 7.4
CVE-2025-40800 A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V25…
High 7.2
CVE-2024-56837 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al…
High 7.2
CVE-2024-56838 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al…
High 7.2
CVE-2024-56839 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al…
High 7.2
CVE-2024-56840 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (Al…

Medium9 Show

Low1 Show

Low 3.3
CVE-2025-40818 A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server…