CVE-2025-39760 Siemens CVE debrief

Who should care

Security and operations teams responsible for Siemens SIMATIC CN 4100 deployments, especially systems that include Linux kernel USB parsing code or accept removable USB media. OT/ICS administrators, embedded platform maintainers, and asset owners should also review exposure if they rely on the vendor-referenced product line or any Linux-based component that processes untrusted USB descriptors.

Technical summary

The issue is an out-of-bounds read risk in USB SuperSpeed endpoint companion parsing. Per the advisory text, the bug arises because descriptor type was checked before size/length, allowing a malformed descriptor to be examined outside the intended buffer bounds. The stated fix is to check the size first before reading any descriptor fields. The supplied source item is a CISA republication of Siemens ProductCERT advisory SSA-032379, and the remediation field specifies updating to V5.0 or later for the affected Siemens product entry.

Defensive priority

Priority should be treated as medium overall, but higher on any exposed OT or embedded systems that parse externally supplied USB descriptors or allow physical USB access. If the Siemens product mapping applies to your environment, remediation should be scheduled promptly during the next maintenance window because the advisory provides a vendor fix path and the flaw can be triggered without user interaction under the stated CVSS vector.

Recommended defensive actions

• Confirm whether any deployed Siemens SIMATIC CN 4100 systems match the advisory's version scope and verify the vendor bulletin before making changes.
• Update to V5.0 or later if the Siemens advisory applies to your environment.
• Restrict or control physical USB access on affected or potentially affected systems.
• Use asset inventory to identify Linux-based embedded or OT devices that parse untrusted USB descriptors.
• Apply compensating controls during remediation windows, such as limiting removable media use and monitoring for anomalous USB activity.
• Review the linked CISA and Siemens advisories for any vendor-specific mitigations or validation steps.

Evidence notes

The source corpus contains a CISA CSAF advisory (ICSA-26-134-10) published on 2026-05-12 and republished on 2026-05-14 from Siemens ProductCERT SSA-032379. The CVE description explicitly names a Linux kernel USB core parsing issue. The vendor/product fields in the supplied data map the issue to Siemens SIMATIC CN 4100 vers:intdot/<5.0, but that mapping is marked low confidence and needs review, so this debrief avoids asserting product impact beyond the advisory metadata. No KEV entry is present in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.