These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2025-40936 affects Siemens Solid Edge and is described as an out-of-bounds read while parsing specially crafted IGS files. The issue can be used to crash the application or execute code in the context of the current process. CISA published ICSA-26-043-05 on 2026-02-10 and republished it on 2026-02-12 with Siemens ProductCERT SSA-445819 advisory material. The supplied CVSS vector rates the issue High a [truncated]
CVE-2025-40587 is a stored cross-site scripting issue in Siemens Polarion affecting document titles. According to the advisory metadata, an authenticated remote attacker can place arbitrary JavaScript into a specially crafted document title, and that content may execute when other users later view it. Siemens and CISA list fixes for Polarion V2404 and V2410, and the issue is rated HIGH with a CVSS 3.1 score of 7.6.
CVE-2025-0836 is a medium-severity authorization flaw published on 2026-02-10 and republished by CISA on 2026-02-12. The advisory says users with read-only access to the Management Server may gain full read/write access to the MIP Webhooks API, so organizations should treat Management Server role settings as security-sensitive until patched.
CVE-2025-6141 is a locally exploitable stack-based buffer overflow in GNU ncurses, affecting the postprocess_termcap function in tinfo/parse_entry.c. Siemens and CISA republished the issue for affected industrial networking products, including the named RUGGEDCOM RST2428P and multiple SCALANCE families, and Siemens advises upgrading to V3.3 or later.
CVE-2025-4517 is a critical arbitrary filesystem write issue described in the supplied CISA/Siemens advisory corpus. The vulnerability is triggered when untrusted tar archives are extracted with Python tarfile APIs using filter="data" or filter="tar". For Python 3.14 and later, the advisory notes that the default filter changed to "data", so code relying on that default can also be exposed. In the Siemens [truncated]
CVE-2025-4516 is described as a CPython issue involving bytes.decode("unicode_escape", error="ignore|replace"). The supplied advisory corpus also maps the issue to Siemens industrial products and recommends updating affected devices to V3.3 or later. If your software does not use the unicode_escape encoding or an error handler, the Python-side issue is not affected. For Siemens OT environments, treat the [truncated]
CVE-2025-4435 is a high-severity Siemens advisory about archive extraction behavior that does not match the documented security expectation when TarFile.errorlevel = 0 is used with a filter. Instead of skipping filtered members, affected versions may still extract them. In practice, that can defeat file-selection controls and undermine security assumptions around handling untrusted archives. CISA republis [truncated]
CVE-2025-4330 is an integrity-focused archive-extraction flaw described in Siemens' advisory for SINEC OS-based products, including the RUGGEDCOM RST2428P and multiple SCALANCE families. When untrusted tar archives are extracted with TarFile.extractall() or TarFile.extract() using filter="data" or filter="tar"—and, for Python 3.14+, when relying on the new default filter="data"—the extraction filter can b [truncated]
CVE-2025-4138 is a High-severity issue republished by CISA for Siemens products in ICSA-26-043-06. The vulnerability description in the source record says tarfile extraction filters can be ignored, allowing symlink targets to point outside the intended destination directory and permitting some file metadata changes. Siemens’ advisory materials direct affected users to update to V3.3 or later, and CISA’s l [truncated]
CVE-2025-39865 describes a Linux kernel NULL pointer dereference in the OP-TEE shared-memory cleanup path. According to the advisory, __optee_disable_shm_cache can receive a NULL result from reg_pair_to_ptr and then pass it to tee_shm_free/tee_shm_put, which can crash the kernel. The supplied crash log shows a kernel paging request and oops during a shutdown/hibernate sequence. CISA’s advisory republished [truncated]
CVE-2025-39864 is described in the source advisory as a Linux kernel cfg80211 use-after-free in cmp_bss()/cfg80211_update_known_bss(). The issue is tied to beacon-frame element lifetime handling after a prior bss_free() quirk, and the listed fix is to avoid freeing shared elements referenced by hidden_beacon_bss. The source metadata maps the advisory to Siemens SIMATIC CN 4100 versions before 5.0, but the [truncated]
CVE-2025-39860 describes a race in the Linux kernel Bluetooth L2CAP socket cleanup path, specifically l2cap_sock_cleanup_listen(), that can result in a use-after-free. The advisory says concurrent socket handling could let two threads act on the same socket, causing a premature free and later access to freed memory. The supplied advisory rates the issue CVSS 7.1 (HIGH). It also maps the issue to Siemens S [truncated]
CVE-2025-39853 describes a potential invalid memory access when an i40e MAC list is empty and code dereferences the result of list_first_entry(). The fix changes this to list_first_entry_or_null(), which avoids dereferencing an invalid pointer when the list has no entries. The supplied advisory metadata associates the issue with Siemens SIMATIC CN 4100 vers:intdot/<5.0, so applicability should be validate [truncated]
CVE-2025-39846 is a medium-severity Linux kernel vulnerability described as a NULL pointer dereference in __iodyn_find_io_region(). The issue occurs when pcmcia_make_resource() returns NULL and the result is passed into pci_bus_alloc_resource() without a check, which can trigger a crash. The supplied advisory corpus ties the issue to Siemens SIMATIC CN 4100 metadata and recommends updating to V5.0 or later.
CVE-2025-39841 is a high-severity memory-safety flaw described in the Linux kernel lpfc deferred receive path. The advisory says the buffer was freed before its context pointer was cleared, creating a use-after-free window and possible double-free condition when concurrent paths inspect the same pointer. CISA’s advisory ties the issue to Siemens SIMATIC CN 4100 and recommends updating to V5.0 or later.
CVE-2025-39839 is a medium-severity Linux kernel flaw in batman-adv network-coding decode. The issue occurs because batadv_nc_skb_decode_packet() trusts coded_len, checks only against skb->len, and does not verify the source skb length before XOR operations. That can lead to an out-of-bounds read and a small out-of-bounds write when the payload bounds are exceeded. The source advisory published on 2026-05 [truncated]
CVE-2025-38345 was publicly disclosed in the Siemens/CISA advisory stream on 2026-01-28 and republished by CISA on 2026-02-25 after scope updates. The issue is a Linux kernel ACPICA operand cache leak that can surface during ACPI early termination on affected Siemens OT products, with Siemens directing customers to update to V3.3 or later.
CVE-2025-38086 is a HIGH-severity Linux kernel issue tied to Siemens industrial OT firmware. In the ch9200 MDIO read path, an error from control_read() is not checked, so an uninitialized local buffer can be read during mii_nway_restart(). Siemens’ advisory, republished by CISA, says affected products should be updated to V3.3 or later.
CVE-2025-38085 is a Siemens-adopted Linux kernel issue affecting SINEC OS firmware on multiple industrial products, with CISA republishing Siemens ProductCERT advisory SSA-089022 as ICSA-26-043-06. The vulnerable behavior is a race between huge_pmd_unshare() and gup_fast() that can cause one process to walk page tables associated with another process. In the supplied advisory text, the issue is described [truncated]
CVE-2025-38084 is a high-severity local Linux kernel memory-management race that Siemens and CISA republished for affected SINEC OS firmware. The issue is in hugetlb page-table handling during VMA split: unsharing happened too early, before the relevant VMA and rmap locks were held, creating a race window. Siemens’ remediation is to update affected products to V3.3 or later.
CVE-2025-3360 is a GLib parsing flaw triggered by a long invalid ISO 8601 timestamp passed to g_date_time_new_from_iso8601(). In the Siemens advisory trail republished by CISA, the issue is tied to affected SINEC OS firmware and mitigated by updating to V3.3 or later. The published CVSS rating is low (3.7), with impact limited to availability.
Siemens’ advisory, republished by CISA as ICSA-26-043-06, ties CVE-2025-27587 to OpenSSL 3.0.0 through 3.3.2 on PowerPC-based systems used in Siemens OT products including RUGGEDCOM RST2428P and the SCALANCE family. The source describes a Minerva-style timing side-channel during EVP_DigestSign operations that could, under the conditions described, help an attacker infer nonce-related information and poten [truncated]
CVE-2025-1390 is a local privilege-escalation issue in the libcap PAM module pam_cap.so as described in Siemens and CISA advisories. In affected Siemens industrial products, parsing of /etc/security/capability.conf can incorrectly treat entries that do not start with “@” as group names, which may cause unintended users to inherit capabilities. Siemens’ remediation is to update to V3.3 or later for impacted products.
CVE-2025-0725 is a high-severity memory-corruption issue in the libcurl/zlib handling path described by Siemens and CISA. In affected Siemens industrial products, automatic gzip decompression of HTTP content-encoded responses can trigger an attacker-controlled integer overflow and then a buffer overflow. Siemens and CISA identify update guidance for affected products, with remediation to V3.3 or later.
CVE-2025-0665 is a Siemens advisory item tied to a libcurl file-descriptor handling flaw in SINEC OS firmware and related Siemens industrial networking products. The issue can cause the same eventfd file descriptor to be closed twice during connection teardown after threaded name resolution. Siemens provides a fix in V3.3 or later, and CISA republished the advisory with later scope clarifications. Given t [truncated]
CVE-2024-8006 is a denial-of-service vulnerability in libpcap’s remote packet capture support. The affected function, pcap_findalldevs_ex(), is only available when libpcap is built with remote packet capture enabled, which Siemens notes is disabled by default. In the vulnerable path, a failed opendir() result is not checked before the code passes NULL to readdir(), leading to a NULL pointer dereference an [truncated]
CVE-2024-52533 is a critical memory-corruption issue that Siemens and CISA republished for industrial networking products running SINEC OS firmware. The flaw is described as an off-by-one error in GNOME GLib before 2.82.1, where a SOCKS4 connection message length is not sufficient for a trailing NUL byte, resulting in a buffer overflow. For affected Siemens devices, the practical takeaway is to move to Si [truncated]
CVE-2024-47619 describes a TLS certificate hostname-checking flaw where syslog-ng’s wildcard matcher accepted invalid patterns such as "foo.*.bar" and partial wildcards like "foo.a*c.bar". In the Siemens/CISA advisory context, the issue is mapped to SINEC OS firmware on affected RUGGEDCOM and SCALANCE products. Because the flaw is network-reachable and can affect TLS connection trust, it matters most wher [truncated]
CVE-2024-41996 is a remote, unauthenticated availability issue in Siemens SIDIS Prime. A client can influence Diffie-Hellman negotiation in a way that causes unnecessarily expensive server-side modular-exponentiation work when the server is configured to allow DHE and validate public-key order. The practical risk is asymmetric resource consumption that can degrade service availability.
The supplied advisory data ties CVE-2024-12718 to Siemens products and remediation guidance, while the CVE description itself says the issue affects Python 3.12+ tarfile extraction filters. In the source corpus, the issue is rated medium severity and the vendor remediation is to update affected Siemens products to V3.3 or later. CISA republished the advisory on 2026-02-25 after the initial 2026-01-28 publication.