PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-31257 Cert Portal CVE debrief

CVE-2025-31257 is a medium-severity advisory record in the supplied corpus that points to Siemens SIMATIC CN 4100 versions earlier than V5.0. The vendor remediation is to update to V5.0 or later. The source text says the issue was addressed with improved memory handling and that processing maliciously crafted web content may lead to an unexpected crash. The supplied metadata also contains a product/description mismatch, so defenders should verify the advisory details against the linked Siemens and CISA sources before taking action.

Vendor
Cert Portal
Product
Siemens SIMATIC CN 4100 vers:intdot/<5.0
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Operators, administrators, and asset owners responsible for Siemens SIMATIC CN 4100 deployments, especially environments running versions earlier than V5.0. Security teams supporting industrial systems should also review the advisory and confirm whether any affected devices are present.

Technical summary

The supplied advisory metadata identifies an issue in Siemens SIMATIC CN 4100 vers:intdot/<5.0 and lists a fix in V5.0 or later. The description states the issue was addressed with improved memory handling and that malformed web content may trigger an unexpected crash. Based on the provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L), the impact is limited to availability, with user interaction required. The record should be treated cautiously because the description text and product metadata are not fully aligned.

Defensive priority

Medium priority. The CVSS score is 4.7 and the impact is described as availability-only, but the affected product is an industrial system, so verified exposure should be patched during the next maintenance window.

Recommended defensive actions

  • Confirm whether Siemens SIMATIC CN 4100 is deployed and identify versions earlier than V5.0.
  • Review the Siemens advisory and CISA republication linked in the record to verify affected configurations.
  • Apply the vendor fix by upgrading to V5.0 or later.
  • Schedule the update during a controlled maintenance window and validate system behavior after upgrade.
  • Monitor affected assets for unexpected crashes or instability until remediation is complete.

Evidence notes

The source item is CISA CSAF ICSA-26-134-10, published 2026-05-12 and republished by CISA on 2026-05-14 from Siemens ProductCERT advisory SSA-032379. The remediation section in the supplied metadata states: 'Update to V5.0 or later version.' The advisory metadata lists CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L and a score of 4.7. The record also includes a description mentioning improved memory handling and an unexpected crash, but the product metadata identifies Siemens SIMATIC CN 4100, so the exact affected component should be verified against the official advisory links.

Official resources

Publicly disclosed in the CISA CSAF advisory published on 2026-05-12, with CISA republication of the Siemens ProductCERT advisory on 2026-05-14. This entry is not marked as CISA KEV in the supplied data.