CVE-2025-46836 Cert Portal CVE debrief

Who should care

OT operators, Siemens RUGGEDCOM ROX administrators, and security teams responsible for embedded Linux management access, local console users, or device maintenance on affected industrial networking appliances.

Technical summary

The underlying flaw is a bounds-checking failure in get_name() in interface.c. When interface names/labels are read from /proc/net/dev, they are copied into a fixed-size 16-byte stack buffer without proper validation. The source description frames the issue as affecting net-tools versions up to and including 2.10, while the Siemens advisory maps remediation to specific RUGGEDCOM ROX products below version 2.17.1. The practical impact is local memory corruption with crash risk and potential code execution, but no privilege escalation is claimed in the supplied material.

Defensive priority

Medium overall, but treat as higher priority in OT environments because a local, unprivileged crash or memory-corruption event can disrupt device availability.

Recommended defensive actions

• Apply the Siemens advisory remediation and update affected RUGGEDCOM ROX products to v2.17.1 or later.
• Inventory affected Siemens RUGGEDCOM ROX models and confirm whether net-tools is present in the deployed firmware or package set.
• Restrict local and maintenance access to trusted administrators only, and limit opportunities for untrusted users to interact with the device shell or interface management utilities.
• Schedule updates during a maintenance window and validate device behavior after patching to confirm interface reporting functions normally.
• Monitor for unexpected crashes, abnormal restarts, or interface-display failures on affected devices until remediation is complete.
• Use defense-in-depth controls from CISA ICS guidance to reduce the impact of local compromise or tampering on industrial devices.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-134-16, which republishes Siemens ProductCERT advisory SSA-577017. The supplied source describes a stack-based buffer overflow in net-tools get_name() while processing /proc/net/dev, lists affected Siemens RUGGEDCOM ROX products, and recommends updating to v2.17.1 or later. The source description also says a patch is expected in net-tools 2.20, creating a versioning inconsistency that should be resolved by following the vendor advisory for product-specific remediation.

Official resources