The vulnerability identified as CVE-2026-22925 affects Siemens SIMATIC CN 4100 devices running versions earlier than V5.0. It stems from improper handling of resource allocation under high TCP SYN packet loads, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker can exploit this by sending a large number of TCP SYN packets, causing resource exhaustion and denial-of-service (DoS) conditions. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. There is no vendor advisory or patch available at this time.

Successful exploitation results in denial-of-service by exhausting system resources through a flood of TCP SYN packets. This disrupts normal operation of the SIMATIC CN 4100 device, causing service unavailability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as SYN flood mitigation on upstream devices or firewalls to reduce exposure. Monitor for unusual TCP SYN traffic patterns targeting the device. No official vendor mitigation or workaround has been published.