PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-1390 Siemens CVE debrief

CVE-2025-1390 is a local privilege-escalation issue in the libcap PAM module pam_cap.so as described in Siemens and CISA advisories. In affected Siemens industrial products, parsing of /etc/security/capability.conf can incorrectly treat entries that do not start with “@” as group names, which may cause unintended users to inherit capabilities. Siemens’ remediation is to update to V3.3 or later for impacted products.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-28
Original CVE updated
2026-02-25
Advisory published
2026-01-28
Advisory updated
2026-02-25

Who should care

OT/ICS operators, Siemens product administrators, and Linux/system administrators responsible for affected RUGGEDCOM and SCALANCE deployments that use pam_cap and /etc/security/capability.conf.

Technical summary

The advisory states that pam_cap.so supports group names starting with “@”, but during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. If capability.conf is used to assign inherited privileges, this parsing error can grant a nonintended user an inherited capability set. The reported impact is local privilege escalation with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N (6.1 Medium).

Defensive priority

Medium to high for affected Siemens OT/Linux systems: the attack is local, but the impact includes privilege escalation and the issue affects privilege-handling configuration.

Recommended defensive actions

  • Update affected Siemens products to V3.3 or later, per the vendor remediation guidance.
  • Review any use of /etc/security/capability.conf and verify that privilege assignments only apply to intended users and groups.
  • Limit local access and privileged shell access on affected systems until remediation is complete.
  • Confirm whether the deployed firmware/product version is within the affected Siemens product list, especially after CISA’s later product-scope clarifications.
  • Use defense-in-depth and least-privilege controls so a configuration parsing error cannot broadly elevate user capabilities.

Evidence notes

Primary source material is Siemens ProductCERT advisory SSA-089022 and CISA’s ICSA-26-043-06 republication. The supplied advisory text explicitly says pam_cap.so misparses capability.conf entries, potentially granting unintended inherited capabilities and enabling local privilege escalation. The remediation text in the source corpus specifies updating to V3.3 or later. CISA’s revision history shows the advisory was initially published on 2026-01-28 and updated through 2026-02-25, including scope clarifications for affected Siemens products.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-1390 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-1390

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-1390 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-1390

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-089022.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-089022.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.