PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-6141 Siemens CVE debrief

CVE-2025-6141 is a locally exploitable stack-based buffer overflow in GNU ncurses, affecting the postprocess_termcap function in tinfo/parse_entry.c. Siemens and CISA republished the issue for affected industrial networking products, including the named RUGGEDCOM RST2428P and multiple SCALANCE families, and Siemens advises upgrading to V3.3 or later.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-28
Original CVE updated
2026-02-25
Advisory published
2026-01-28
Advisory updated
2026-02-25

Who should care

Siemens OT/ICS operators and asset owners using affected RUGGEDCOM or SCALANCE devices, especially where SINEC OS firmware is deployed. Teams that allow local or maintenance access to these systems should treat this as a patching priority.

Technical summary

The advisory describes a stack-based buffer overflow in GNU ncurses up to 6.5-20250322. The affected path is postprocess_termcap in tinfo/parse_entry.c. The published CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, so exploitation requires local access and is scored low, but the issue is relevant to Siemens industrial devices because the vendor guidance recommends updating affected products to V3.3 or later. The CISA republication history shows the advisory was initially published on 2026-01-28 and later updated on 2026-02-12, 2026-02-24, and 2026-02-25.

Defensive priority

Medium for affected Siemens OT assets; otherwise low.

Recommended defensive actions

  • Upgrade affected Siemens products to V3.3 or later, per the vendor remediation guidance.
  • Confirm whether your deployed device model and firmware are on the affected list, including RUGGEDCOM RST2428P and the listed SCALANCE families.
  • Verify whether the system uses SINEC OS firmware, since the updated advisory clarifies that SINEC OS firmware is impacted.
  • Review Siemens advisory SSA-089022 and CISA ICSA-26-043-06 for product-specific remediation notes and any additional information.
  • Restrict local and maintenance access to affected devices until remediation is complete.

Evidence notes

The source corpus states that GNU ncurses up to 6.5-20250322 is affected and that upgrading to 6.5-20250329 addresses the library issue. Siemens/CISA advisory metadata ties the issue to Siemens industrial products, with remediation to V3.3 or later. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, matching a local-access condition. CISA revision history records the advisory timeline and later clarification that only SINEC OS firmware is impacted.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-6141 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-6141

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-6141 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-6141

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-089022.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-089022.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.