Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-39997)

info Tenable OT Security Plugin ID 506396

Synopsis

The remote OT asset is affected by a vulnerability.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

The previous commit 0718a78f6a9f ('ALSA: usb-audio: Kill timer properly at removal') patched a UAF issue caused by the error timer.

However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely.

Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF.

Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: Info

ID: 506396

File Name: tenable_ot_siemens_CVE-2025-39997.nasl

Version: 1.1

Type: Remote

Family: Tenable.ot

Published: 10/20/2026

Updated: 10/20/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.22

CVSS v3

Risk Factor: Info

Base Score: 0

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N

Vulnerability Information

CPE: cpe:/o:siemens:simatic_s7-1500_tm_mfp

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 10/13/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2025-39997

CWE: 20

Detections

Analytics