GCVE-110-NCSC-2026-5

Advisory PublishedCVSS 10.0/10

Vulnetix · Advisory published January 13, 2026

A vulnerability in certain devices allows unauthenticated remote attackers to bypass user authentication on specific API endpoints, potentially impersonating legitimate users if they know the user's identity.

Download JSON Open in Console

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-250Execution with Unnecessary PrivilegesCWE-400Uncontrolled Resource Consumption

Risk Scores

CVSS 3.1

10.0/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Siemens	vers:unknown/*	—	—

Aliases

CVE-2025-40805 CVE-2025-40891 CVE-2025-40892 CVE-2025-40893 CVE-2025-40898 CVE-2025-40942 CVE-2025-40944

References

advisory

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON