CVE-2025-40795 is a stack-based buffer overflow vulnerability in the integrated User Management Component (UMC) of Siemens SIMATIC PCS neo products. Affected versions include all versions of SIMATIC PCS neo V4.1 and V5.0, and versions of V6.0 prior to SP1 Update 1, as well as UMC versions prior to 2.15.1.3. The vulnerability allows unauthenticated remote attackers to execute arbitrary code or cause denial of service conditions due to improper handling of input leading to buffer overflow on the stack.

Successful exploitation can lead to full system compromise, including arbitrary code execution with high impact on confidentiality, integrity, and availability. The vulnerability can be triggered remotely without authentication or user interaction, making it highly exploitable and dangerous in affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the current data. Users should monitor Siemens advisories closely and apply updates or mitigations as soon as they become available. Until a patch is released, restricting network access to the affected components and employing intrusion detection may reduce exposure.