CVE-2025-11495 Siemens CVE debrief

Who should care

Operators and engineers responsible for affected Siemens SIMATIC S7-1500 CPU 1518 MFP devices, especially environments that allow local shell access, application builds, or other interactive use of the device’s GNU/Linux subsystem.

Technical summary

The source description identifies a heap-based buffer overflow in the linker function elf_x86_64_relocate_section within elf64-x86-64.c in GNU Binutils 2.45. The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating a locally reachable issue with limited availability impact. Siemens’ advisory ties the CVE to five affected product identifiers in the SIMATIC S7-1500 CPU 1518 MFP family and states that no fix is currently available in the advisory corpus.

Defensive priority

Medium for affected OT operators: the CVSS score is low, but the issue is publicly disclosed, locally exploitable, and mapped to industrial controller products where local access is often tightly controlled and operationally sensitive.

Recommended defensive actions

• Confirm whether any of the listed SIMATIC S7-1500 CPU 1518 MFP product variants are present in your environment.
• Restrict interactive shell access to the additional GNU/Linux subsystem to trusted personnel only.
• Only build and run applications from trusted sources on affected systems.
• Monitor Siemens ProductCERT and CISA advisory updates for a validated fix or further guidance.
• Plan to deploy the vendor patch or validated remediation once one is made available and tested in your environment.

Evidence notes

The supplied CISA CSAF source (ICSA-25-162-05 / SSA-082556) lists Siemens as the vendor, identifies five affected SIMATIC S7-1500 CPU 1518 MFP products, and includes mitigations that limit shell access and trusted-source usage. The source description states the flaw is in GNU Binutils 2.45, causes a heap-based buffer overflow in elf_x86_64_relocate_section, is locally executable, and has been publicly disclosed. The advisory metadata shows publication on 2025-06-10 and a latest update on 2026-05-14.

Official resources