PatchSiren cyber security CVE debrief

CVE-2025-4598 Siemens CVE debrief

A race condition vulnerability in systemd-coredump affects Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP devices. The flaw allows an attacker with local access to force a SUID process to crash, then exploit PID recycling to gain access to privileged process coredump data before systemd-coredump can analyze /proc/pid/auxv. Successful exploitation could expose sensitive memory contents such as /etc/shadow. The vulnerability requires local access, low privileges, and high attack complexity due to the race condition. No patch is currently available.

Vendor: Siemens
Product: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS: MEDIUM 4.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-06-10
Original CVE updated: 2026-05-14
Advisory published: 2025-06-10
Advisory updated: 2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP devices in industrial environments, particularly those with multi-user access to the embedded GNU/Linux subsystem or applications utilizing SUID binaries.

Technical summary

The vulnerability exists in systemd-coredump's handling of SUID process crashes. When a SUID process crashes, systemd-coredump attempts to analyze /proc/pid/auxv to determine process privileges. An attacker can trigger a crash and race to recycle the PID with a non-SUID binary before systemd-coredump completes its analysis. If successful, the attacker gains access to the original SUID process's coredump file, which may contain sensitive data loaded into memory by the privileged process. The attack requires local access and is rated MEDIUM severity (CVSS 4.7) due to high attack complexity.

Defensive priority

medium

Recommended defensive actions

Restrict interactive shell access to the GNU/Linux subsystem on affected devices to trusted personnel only
Only build and run applications from trusted sources on affected systems
Monitor for unexpected SUID process crashes and coredump generation on affected devices
Apply security updates from Siemens when available for the SIMATIC S7-1500 CPU 1518-4 PN/DP MFP product family

Evidence notes

The vulnerability description indicates this is a race condition (CWE-364) in systemd-coredump where an attacker can force a SUID process crash and exploit Linux kernel PID recycling to access privileged coredump data. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local attack vector, high complexity, low privileges required, and high confidentiality impact with no integrity or availability impact.

Official resources

2025-06-10