CVE-2025-39756
View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS va...
Affects 2 products across 3 vendors.
Software does not release allocated memory after use, causing progressive consumption until failure.
The Siemens SIMATIC CN 4100 is affected by multiple vulnerabilities, including NULL Pointer Dereference, Reachable Assertion, Use After Free, and Out-of-bounds Write, which could potentially lead to a compromise in availability, integrity, and confidentiality. Siemens recommends updating to the latest version to mitigate these risks.
BSID: BS-2026-GLOBAL-257534-H • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-39756?
What is the CVSS score for CVE-2025-39756?
Is CVE-2025-39756 actively exploited?
How do I remediate CVE-2025-39756?
What systems are affected by CVE-2025-39756?
What NERC-CIP standard applies to CVE-2025-39756?
What IEC 62443 requirement maps to CVE-2025-39756?
| CVE ID | CVE-2025-39756 |
|---|---|
| BSID | BS-2026-GLOBAL-257534-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Published | 2026-07-28 |
| Last Modified | 2026-07-28 |
| ICS Relevance | 65% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.6
Source: NIST NVD / MITRE CVE Database
The vulnerabilities are locally exploitable with low privileges and do not require user interaction. The primary risk is a high impact on availability, which could affect the operational continuity of the affected systems.
Exploitation Likelihood: LOW
| Vendor | Product | Fixed Version |
|---|---|---|
| Debian | Debian Linux | — |
| Linux | Linux Kernel | — |
| Siemens | — | — |
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement network segmentation to isolate the affected SIMATIC CN 4100 devices from other critical systems. Regularly monitor the network for any suspicious activity.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
This CVE could allow an attacker to compromise the availability of the SIMATIC CN 4100, which is a critical component in the control system. CIP-007-R2 requires the implementation of security controls to protect against unauthorized access and ensure the availability of critical assets.
The vulnerabilities in the SIMATIC CN 4100 could be exploited to affect the availability and integrity of the control system. SR 7.6 requires the implementation of security measures to protect against such threats and ensure the reliable operation of the system.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
SAGE Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | bcfa6aa740e4481db0e1274f993cf9855d760483e41b7a8c5d5a2df2094ba4b2788edb1f7040ebfe49063a04b06d18763ea7fe8a5576090247865e261ff8ff20 |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →