CVE-2025-21795 Siemens CVE debrief

Who should care

Siemens SIMATIC S7-1500 CPU operators, OT/ICS administrators, and teams managing the device’s additional GNU/Linux subsystem should pay attention. This is most relevant where availability of the controller or its Linux/NFSD-dependent functions matters and where local access is possible.

Technical summary

The source description says NFSD can hang in nfsd4_shutdown_callback because a courtesy-state nfs4_client does not need a callback, yet cl_cb_inflight remains non-zero while the callback path waits. The advisory ties the issue to Siemens SIMATIC S7-1500 CPU family products and notes a roughly 15-minute delay before TCP notifies NFSD that the connection was dropped. The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local, low-privilege conditions with high availability impact only.

Defensive priority

Medium. The issue is not credential theft or code execution, but it can stall NFSD-related activity and temporarily affect service availability on affected Siemens systems. Prioritize if the device relies on the GNU/Linux subsystem or NFS-related functionality and if uptime is operationally important.

Recommended defensive actions

• Review whether any affected SIMATIC S7-1500 CPU models are in use: 6ES7518-4AX00-1AB0, 6ES7518-4AX00-1AC0, 6ES7518-4FX00-1AB0, 6ES7518-4FX00-1AC0, and 6AG1518-4AX00-4AC0.
• Apply Siemens and CISA guidance from the referenced advisory pages for operational mitigations and monitoring.
• Limit access to the additional GNU/Linux subsystem shell to trusted personnel only, as recommended in the source advisory.
• Only build and run applications from trusted sources on affected systems, as recommended in the source advisory.
• Plan for availability impacts and monitoring around NFSD behavior, especially if local access or subsystem usage is possible.
• Track Siemens/CISA updates for a fixed version or additional remediation guidance, since the source set states no fix was available at publication.

Evidence notes

All key claims are supported by the supplied CISA CSAF source item and its listed Siemens/CISA references. The advisory metadata identifies the affected Siemens SIMATIC S7-1500 CPU family, the issue description states the NFSD shutdown hang and ~15-minute delay, the CVSS vector is provided in the source, and the remediation field states that no fix is currently available. No KEV entry is listed in the supplied enrichment.

Official resources