Lucene search
+L

CVE-2025-40314

🗓️ 08 Dec 2025 00:46:40Reported by LinuxType 
cve
 cve
🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 32 Views

Fix use-after-free in cdns3 gadget by freeing endpoints before gadget release and separating del and put steps.

Related
Detection
Affected
Refs
Social
Vulners
CNA
Node
OR
linuxlinux_kernelRange5.35.15.197
linuxlinux_kernelRange5.16.06.1.159
linuxlinux_kernelRange6.2.06.6.117
linuxlinux_kernelRange6.7.06.12.58
linuxlinux_kernelRange6.13.06.17.8
linuxlinux_kernelRange6.18.0
[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/usb/cdns3/cdnsp-gadget.c"
    ],
    "versions": [
      {
        "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
        "lessThan": "0cf9a50af91fbdac3849f8d950e883a3eaa3ecea",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
        "lessThan": "37158ce6ba964b62d1e3eebd11f03c6900a52dd1",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
        "lessThan": "ea37884097a0931abb8e11e40eacfb25e9fdb5e9",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
        "lessThan": "9c52f01429c377a2d32cafc977465f37b5384f77",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
        "lessThan": "fdf573c517627a96f5040f988e9b21267806be5c",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8bc1901ca7b07d864fca11461b3875b31f949765",
        "lessThan": "87c5ff5615dc0a37167e8faf3adeeddc6f1344a3",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/usb/cdns3/cdnsp-gadget.c"
    ],
    "versions": [
      {
        "version": "5.3",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.3",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.197",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.159",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.117",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.58",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.17.8",
        "lessThanOrEqual": "6.17.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

syedaquib77

Vulnerability Alert: ICS Vulnerabilities in Siemens, Schneider Electric, and ABB Products Timeline: Disclosure: 2025-04-22, Patch: TBA Attribution: CISA CVE ID: CVE-2025-40312 Base Score: 9.3 cvssSeverity: Critical ExploitMaturity: Not Available AffectedVersions: - Siemens TeleControl Server Basic SQL - Siemens TeleControl Server Basic - Schneider Electric Wiser Home Controller WHC-5918A - ABB MV Drives - Schneider Electric Modicon M580 PLCs - BMENOR2200H - EVLink Pro AC FixedVersions: - Patches and firmware updates available from Siemens and Schneider Electric Attack Vectors: - SQL Injection - Privilege Escalation - Authentication Bypass - Remote Command Execution - Denial of Service Summary: CISA has issued five advisories for critical vulnerabilities affecting Industrial Control Systems (ICS) from Siemens, Schneider Electric, and ABB. These vulnerabilities include SQL injection flaws (CVE-2025-40312, CVE-2025-40313) in Siemens TeleControl Server Basic SQL allowing unauthorized database access, a privilege escalation flaw (CVE-2025-40314) in Siemens TeleControl Server Basic, authentication bypass (CVE-2025-40321) and remote command execution (CVE-2025-40322) in Schneider Electric Wiser Home Controller WHC-5918A, an information exposure vulnerability (CVE-2024-6407) with a CVSS v4 score of 9.3 in Schneider Electric products, and a denial-of-service (DoS) vulnerability (CVE-2025-40987) in ABB MV Drives. Exploitation of these vulnerabilities could lead to data theft, manipulation, disruption of operations, or safety incidents in industrial automation and critical infrastructure. Impact Scope: Potential for data theft, manipulation, and operational disruption in critical infrastructure. Recommended Actions: - Apply patches and firmware updates from Siemens and Schneider Electric promptly - Restrict network access - Audit user privileges Related Resources: - https://t.co/XPbuYzDpyy - https://t.co/sz0omqTSvz - https://t.co/VvhNk7NuGg - https://t.co/TW9N037sF1 - https://t.co/zqi85BjNPO - https://t.co/A7IKrysT43 - https://t.co/x6GVw7fLsc - https://t.co/dKBhZGWUou Tags: #ICS #CISA #Siemens #SchneiderElectric #ABB #Vulnerabilities #SQLInjection #PrivilegeEscalation #AuthenticationBypass #RCE #DoS #CriticalInfrastructure #Cybersecurity

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jun 2026 09:21Current
6.1Medium risk
Vulners AI Score6.1
EPSS0.00187
32