CVE-2025-11413 Siemens CVE debrief

Who should care

OT/ICS teams operating the affected Siemens SIMATIC S7-1500 CPU 1518-4 / 1518F-4 MFP variants, administrators who allow shell access to the device’s GNU/Linux subsystem, and engineering teams that build or deploy applications onto those systems.

Technical summary

The supplied source describes an out-of-bounds read in GNU Binutils 2.45, specifically in elf_link_add_object_symbols within bfd/elflink.c. The attack is local, and the source says the exploit has been made public. Upstream remediation is described as GNU Binutils 2.46, with patch 72efdf166aa0ed72ecc69fc2349af6591a7a19c0 identified in the advisory corpus. The Siemens advisory context links the issue to the SIMATIC S7-1500 CPU family and its additional GNU/Linux subsystem; the remediation section in the source says no fix was available for the affected Siemens products at publication time.

Defensive priority

Low, but worth prompt review in any deployment that exposes the affected GNU/Linux subsystem or allows untrusted local access.

Recommended defensive actions

• Confirm whether any of the affected Siemens SIMATIC S7-1500 CPU MFP variants listed in the advisory are deployed in your environment.
• Restrict interactive shell access to the additional GNU/Linux subsystem to trusted personnel only, as recommended in the source.
• Only build and run applications from trusted sources on affected systems.
• If you control the affected GNU Binutils component directly, upgrade to version 2.46 or later.
• Monitor the Siemens ProductCERT advisory and CISA republication for any product-specific fix or additional guidance.

Evidence notes

The source corpus includes both the Siemens CSAF advisory and the CISA CSAF republication. Those records list the affected Siemens CPU 1518-4 / 1518F-4 MFP product variants and describe mitigation focused on shell-access restriction and trusted software only. The CVE description in the source states the technical root cause as an out-of-bounds read in GNU Binutils 2.45, local attack requirement, public exploit availability, and an upstream fix in 2.46. The source also indicates that no fix was available for the affected Siemens products at the time of the advisory content. Published date used here is 2025-06-10, with the latest source modification date 2026-05-14.

Official resources