CVE-2025-39683 Siemens CVE debrief

Who should care

Administrators and operators responsible for Siemens SIMATIC CN 4100 devices, especially those running versions earlier than 5.0, should prioritize review. Linux kernel maintainers and system teams using tracing/ftrace features should also note the underlying kernel memory-safety issue, particularly in environments where local users can interact with the affected interface.

Technical summary

The source describes an out-of-bounds read in Linux kernel tracing code. If a write to set_ftrace_filter exceeds FTRACE_BUFF_MAX, trace_get_user fails but does not properly terminate parser->buffer. Later cleanup/parsing paths can call strsep on an unterminated buffer, leading to a KASAN-detected slab-out-of-bounds read. The advisory lists CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, indicating local exploitation conditions and potential confidentiality and availability impact.

Defensive priority

High for affected Siemens SIMATIC CN 4100 deployments and any system exposing the relevant tracing interface to untrusted local users. The vulnerability is locally reachable and rated High (7.1), so patching and exposure review should be handled promptly.

Recommended defensive actions

• Update Siemens SIMATIC CN 4100 to V5.0 or later, per the sourced remediation guidance.
• Review whether any local users or services can write to set_ftrace_filter or otherwise reach the tracing path.
• Limit access to kernel tracing interfaces to trusted administrative accounts only.
• Monitor the cited Siemens/CISA advisory pages for any follow-on clarification or product scope updates.
• Verify whether the device inventory matches the advisory mapping, since the source corpus ties a Linux kernel issue to a Siemens product advisory package.

Evidence notes

The supplied source corpus is a CISA CSAF advisory republished from Siemens ProductCERT, published 2026-05-12 and modified 2026-05-14. The description explicitly attributes the flaw to Linux kernel tracing code and names the failing condition, the affected parsing path, and the KASAN out-of-bounds read. The remediation field states: update to V5.0 or later version. The vendor/product mapping in the corpus is low-confidence and should be verified because the technical description is kernel-centric while the advisory package is Siemens SIMATIC CN 4100.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.