CVE-2025-38727
View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS va...
Affects 2 products across 3 vendors.
The Siemens SIMATIC CN 4100 is affected by multiple vulnerabilities, including NULL Pointer Dereference, Reachable Assertion, Use After Free, and Out-of-bounds Write, which could potentially lead to a compromise in availability, integrity, and confidentiality. Siemens has released a new version to address these issues, and users are advised to update to the latest version to mitigate the risks.
BSID: BS-2026-GLOBAL-257002-H • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-38727?
What is the CVSS score for CVE-2025-38727?
Is CVE-2025-38727 actively exploited?
How do I remediate CVE-2025-38727?
What systems are affected by CVE-2025-38727?
What NERC-CIP standard applies to CVE-2025-38727?
What IEC 62443 requirement maps to CVE-2025-38727?
| CVE ID | CVE-2025-38727 |
|---|---|
| BSID | BS-2026-GLOBAL-257002-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Published | 2026-07-28 |
| Last Modified | 2026-07-28 |
| ICS Relevance | 65% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.6
Source: NIST NVD / MITRE CVE Database
The vulnerabilities are locally exploitable, requiring low privileges and no user interaction. The attack does not require network access, making it less likely to be exploited remotely. However, if an attacker gains local access, they could potentially exploit these vulnerabilities to cause a denial of service or gain unauthorized access to the system.
Exploitation Likelihood: LOW
| Vendor | Product | Fixed Version |
|---|---|---|
| Debian | Debian Linux | — |
| Linux | Linux Kernel | — |
| Siemens | — | — |
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict access controls and monitor for any unauthorized access attempts to the SIMATIC CN 4100. Regularly review system logs for any suspicious activity.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
This CVE could allow an attacker to compromise the availability of the control system, which violates the requirement for maintaining the reliability and security of critical cyber assets.
The vulnerabilities could be exploited to compromise the integrity and availability of the control system, which aligns with the security requirement for protecting against unauthorized access and ensuring system reliability.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
SAGE Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | f41d21d8e3f47c1c7d5665544438637d7553cda5a398a8df2eb9a1122fe792e02f48e222ccefe4c237c239dd5c0d1f80aea15d258447e0a5511d9b04b5b42619 |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →