Multiple Vulnerabilities in SIMATIC CN 4100 before V3.0

An attacker with network access or physical access to the device could exploit hardcoded credentials to gain root-level control of the SIMATIC CN 4100, potentially allowing them to alter network configurations, compromise connected control systems, or maintain persistent access. The unrestricted USB port could allow an attacker to boot malicious firmware or bypass security controls.

SIMATIC CN 4100 devices deployed in any water, electric utility, or manufacturing facility using Siemens automation platforms. This includes remote monitoring stations, gateway nodes, and industrial edge computing systems that aggregate data from multiple control devices.

An attacker could connect to the device over the network (HTTP/SSH) and use publicly known or easily discovered hardcoded root credentials to log in and execute commands. Alternatively, an attacker with physical access could connect a USB device to the unrestricted USB port and boot a custom operating system or firmware that bypasses authentication entirely.