PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-42366 Siemens CVE debrief

CVE-2023-42366 is a BusyBox heap-buffer-overflow in awk.c next_token() that Siemens republished for affected OT networking products running SINEC OS firmware. The advisory scope includes RUGGEDCOM RST2428P and multiple SCALANCE families, with remediation directing customers to update to V3.3 or later. The published CVSS vector indicates local attack conditions, no privileges required, user interaction required, and availability impact as the primary concern.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-28
Original CVE updated
2026-02-25
Advisory published
2026-01-28
Advisory updated
2026-02-25

Who should care

Siemens OT/ICS operators, asset owners, and maintenance teams responsible for RUGGEDCOM and SCALANCE devices running SINEC OS firmware, especially where local interactive access or administrative sessions are possible.

Technical summary

The underlying flaw is a heap-buffer-overflow in BusyBox v1.36.1, specifically in the next_token function in awk.c at line 1159. According to the supplied CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), exploitation is locally constrained, requires user interaction, and is expected to affect availability rather than confidentiality or integrity. Siemens and CISA republished the issue under ICSA-26-043-06 / SSA-089022 and point affected customers to firmware version V3.3 or later.

Defensive priority

Medium priority; higher for critical OT sites or devices that cannot be quickly isolated and updated.

Recommended defensive actions

  • Identify whether any Siemens RUGGEDCOM or SCALANCE devices in your environment are running the affected SINEC OS firmware.
  • Plan and apply the vendor remediation to update to V3.3 or later, following Siemens guidance for the specific product model.
  • Use a maintenance window and verify configuration and backup recovery steps before upgrading firmware on production OT devices.
  • Restrict local and interactive access to affected systems until patching is complete, including administrative consoles and any shared operator access.
  • Review Siemens ProductCERT advisory SSA-089022 and CISA advisory ICSA-26-043-06 for model-specific remediation notes.
  • After remediation, confirm firmware versions and document the asset state for future vulnerability management.

Evidence notes

The source advisory description states: 'A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.' The CISA CSAF republication (ICSA-26-043-06) and Siemens advisory references list affected RUGGEDCOM/SCALANCE products and remediation to V3.3 or later. The revision history also records a clarification that only SINEC OS firmware is impacted. No KEV entry or ransomware association is present in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-42366 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-42366

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-42366 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-42366

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-089022.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-089022.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.