PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-21683 Siemens CVE debrief

A memory leak vulnerability exists in the Linux kernel's BPF subsystem, specifically within the bpf_sk_select_reuseport() function. This flaw affects the GNU/Linux subsystem of Siemens SIMATIC S7-1500 TM MFP industrial control devices. The vulnerability allows a local attacker with low privileges to trigger a denial of service condition through memory exhaustion. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. No confidentiality or integrity impacts are associated with this vulnerability.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP devices in industrial automation environments, particularly those utilizing the GNU/Linux subsystem for custom applications or BPF-based networking configurations. Security teams responsible for OT/ICS infrastructure and system administrators managing embedded Linux subsystems on industrial controllers.

Technical summary

The bpf_sk_select_reuseport() function in the Linux kernel BPF subsystem contains a memory leak that can be triggered by local users. This vulnerability affects the GNU/Linux subsystem component of Siemens SIMATIC S7-1500 TM MFP devices. Successful exploitation leads to memory exhaustion and denial of service. The vulnerability requires local access and low privileges, with no user interaction needed. No patch is currently available from the vendor.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Build and run applications exclusively from trusted sources
  • Monitor system memory utilization for anomalous consumption patterns
  • Apply vendor patches when Siemens releases a security update for this vulnerability
  • Implement network segmentation to limit access to affected industrial control devices

Evidence notes

The vulnerability description indicates a memory leak in bpf_sk_select_reuseport(), a BPF helper function used for socket selection in reuseport configurations. The affected product is the GNU/Linux subsystem of Siemens SIMATIC S7-1500 TM MFP, an industrial automation device. The CVSS score of 5.5 (MEDIUM) reflects localized impact with high availability consequences. The advisory notes that currently no fix is available, requiring operational mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-21683 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-21683

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-21683 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-21683

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.