PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38430 Siemens CVE debrief

CVE-2025-38430 concerns a Linux kernel nfsd check that can examine request state without first confirming the request is an NFSv4 COMPOUND operation. The advisory published by CISA on 2025-06-10, based on Siemens ProductCERT material, maps the issue to several SIMATIC S7-1500 CPU MFP products and states that no fix is currently available. The source CVSS vector is local, low-privilege, no-user-interaction, and availability-only, so the main concern is operational disruption rather than data exposure.

Vendor
Siemens
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Siemens SIMATIC S7-1500 CPU operators, OT/ICS maintainers, and administrators responsible for the additional GNU/Linux subsystem should review this issue, especially where local shell or application-building access exists for personnel on affected systems.

Technical summary

The vulnerability is described as a Linux kernel nfsd logic flaw in nfsd4_spo_must_allow(): if the request being processed is not a v4 compound request, examining cstate can lead to undefined results. The patch adds a check that the RPC procedure in rq_procinfo is NFSPROC4_COMPOUND before using that state. In the CISA/Siemens advisory corpus, the CVE is associated with five SIMATIC S7-1500 CPU product variants, and the remediation section says no fix is available at this time.

Defensive priority

Medium. The published CVSS score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which limits exploitability to local access, but the affected Siemens advisory says no fix is available and the impact is availability-focused in an OT environment.

Recommended defensive actions

  • Confirm whether any listed SIMATIC S7-1500 CPU product is present and whether the additional GNU/Linux subsystem is enabled or used.
  • Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
  • Only build and run applications from trusted sources on affected systems.
  • Apply least privilege for local accounts and reduce unnecessary interactive access on the impacted devices.
  • Monitor Siemens ProductCERT and CISA advisory updates for any future remediation guidance and follow ICS defense-in-depth practices.

Evidence notes

The CISA CSAF source item for ICSA-25-162-05 and the Siemens ProductCERT advisory references describe the kernel nfsd issue, the affected Siemens product list, and the statement that no fix is currently available. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) supports a local, availability-only risk profile. The CVE record and NVD link are official identifier and database references.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-38430 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-38430

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-38430 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-38430

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-162-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.