Siemens SIMATIC s7-400 CPU 416f-3 Pn/dp v7 vulnerabilities

2 CVEs affecting Siemens SIMATIC s7-400 CPU 416f-3 Pn/dp v7, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40833, published 2026-05-12.

More from Siemens.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-40820, published 2025-12-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to…
• CVE-2025-40833, published 2026-05-12. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual…