PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-42364 Siemens CVE debrief

CVE-2023-42364 is a BusyBox use-after-free issue tied to awk pattern handling that can crash affected Siemens industrial devices and cause denial of service. CISA’s CSAF advisory for Siemens was published on 2026-01-28 and updated through 2026-02-25; the cited remediation is to move to V3.3 or later where applicable.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-28
Original CVE updated
2026-02-25
Advisory published
2026-01-28
Advisory updated
2026-02-25

Who should care

Operators and maintainers of Siemens industrial network equipment and related OT environments that include the affected SINEC OS firmware or product builds identified in the advisory, especially where BusyBox-based command-line processing may be exposed to trusted users or maintenance workflows.

Technical summary

The advisory describes a use-after-free in BusyBox v1.36.1, specifically in the awk.c evaluate function when processing a crafted awk pattern. The provided CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates local exploitability with user interaction required and a high availability impact, aligning with denial-of-service behavior rather than code execution.

Defensive priority

Medium. The issue is not rated critical, but it can still disrupt availability in industrial environments. Prioritize if the affected Siemens device is operationally important, difficult to service, or exposed to interactive/local maintenance paths.

Recommended defensive actions

  • Apply Siemens guidance to update affected products to V3.3 or later, using the vendor remediation linked in the advisory.
  • Confirm whether the specific device model and firmware branch in your environment actually uses the affected SINEC OS firmware before scheduling change windows.
  • Restrict and monitor local shell or maintenance access on affected systems, since the CVSS vector requires local access and user interaction.
  • Validate availability of rollback and recovery procedures before maintenance, especially for OT assets where downtime is costly.
  • Track the Siemens/CISA advisory updates and re-check affected product mappings after any further republication or revision.

Evidence notes

All core facts come from the supplied CISA CSAF source item and its references: the description states a BusyBox v1.36.1 use-after-free in awk.c evaluate causing denial of service, and the CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The source metadata also records publication on 2026-01-28 and a latest update on 2026-02-25, which should be treated as advisory timing only, not the vulnerability’s origin date.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-42364 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-42364

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-42364 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-42364

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-089022.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-089022.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.