PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-21814 Siemens CVE debrief

A vulnerability in the Linux kernel's PTP (Precision Time Protocol) subsystem affects the GNU/Linux subsystem of Siemens SIMATIC S7-1500 TM MFP industrial controllers. The issue stems from a missing validation that the `info->enable` callback is set before invocation, which can lead to a NULL pointer dereference. This local vulnerability requires low privileges to exploit and results in high availability impact (system crash/denial of service). The vulnerability was disclosed in CISA advisory ICSA-24-102-01 on April 9, 2024, with subsequent updates through September 2025 adding related CVEs. No patch is currently available from the vendor.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

Operators of Siemens SIMATIC S7-1500 TM MFP industrial control systems, OT security teams, and infrastructure owners in manufacturing, energy, and critical infrastructure sectors using this PLC platform should prioritize access controls until a patch is available.

Technical summary

The vulnerability exists in the Linux kernel PTP (Precision Time Protocol) driver where the `info->enable` callback may not be validated as set before invocation. This can result in a NULL pointer dereference when the callback is called on an uninitialized or improperly configured PTP clock device. The flaw requires local access with low privileges to trigger, making it primarily a denial-of-service concern rather than a remote code execution vector. The affected product is the GNU/Linux subsystem within Siemens SIMATIC S7-1500 TM MFP programmable logic controllers, which embed a Linux-based environment for additional application hosting alongside the primary PLC runtime.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources
  • Monitor for anomalous local process activity on affected devices
  • Apply vendor patches when released per Siemens security advisory SSA-265688
  • Implement network segmentation for industrial control systems per CISA ICS recommended practices

Evidence notes

CVE published 2024-04-09 per CISA CSAF advisory ICSA-24-102-01. Advisory subsequently updated 10 times through 2025-09-09 to add related CVEs. CVSS 5.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector with low privileges required, no confidentiality or integrity impact, high availability impact. CWE-476 (NULL Pointer Dereference) classification per source references.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-21814 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-21814

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-21814 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-21814

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.