PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-26465 Siemens CVE debrief

CVE-2025-26465 affects multiple Siemens SIMATIC S7-1500 CPU family products and is tied to OpenSSH behavior when VerifyHostKeyDNS is enabled. According to the advisory, a successful machine-in-the-middle attack requires the attacker to first exhaust the client’s memory resources, which raises the attack complexity, and Siemens notes that no fix is currently available.

Vendor
Siemens
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-02-18
Original CVE updated
2026-09-02
Advisory published
2025-02-18
Advisory updated
2026-09-02

Who should care

Operators and maintainers of the affected Siemens SIMATIC S7-1500 CPU family products, especially teams managing the additional GNU/Linux subsystem, OpenSSH usage, or any configuration that enables VerifyHostKeyDNS. OT security teams should also care because the affected products are industrial controllers in operational environments.

Technical summary

The source advisory describes a weakness in OpenSSH’s host-key verification path when VerifyHostKeyDNS is enabled. Under specific error-handling conditions, a malicious system impersonating a legitimate server may be able to mount a machine-in-the-middle attack, but the advisory states the attacker must first exhaust the client’s memory resource. The reported CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating network reachability, user interaction, and no direct availability impact.

Defensive priority

Medium priority. The issue is externally reachable and can affect confidentiality and integrity, but exploitation is gated by user interaction, a high-complexity condition, and memory-exhaustion prerequisites. Because the advisory says no fix is available, defensive attention should focus on reducing exposure and tightening access now.

Recommended defensive actions

  • Review whether VerifyHostKeyDNS is enabled on affected systems and disable it where it is not required by operational policy.
  • Restrict access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only, as recommended by the advisory.
  • Only build and run applications from trusted sources on the affected products.
  • Monitor Siemens ProductCERT and CISA advisories for a future fix or updated mitigation guidance, since the current advisory states no fix is available.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-25-162-05, the referenced Siemens ProductCERT advisory SSA-082556, and the CVE description provided in the source corpus. Product scope, mitigations, and the 'no fix available' status come from the advisory metadata; timing uses the supplied CVE published date of 2025-06-10 and latest modified date of 2026-05-14.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-26465 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-26465

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-26465 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-26465

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-162-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.