PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-52340 Siemens CVE debrief

CVE-2023-52340 is a denial-of-service vulnerability in the Linux kernel's IPv6 implementation, specifically within net/ipv6/route.c. The vulnerability exists in Linux kernel versions before 6.3, where the max_size threshold for IPv6 routing tables can be easily consumed. This consumption can be triggered when IPv6 packets are sent in a loop via a raw socket, resulting in network unreachability errors and service disruption. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. Siemens has identified this vulnerability as affecting certain industrial networking products, including the RUGGEDCOM RST2428P and SCALANCE product families running SINEC OS. CISA republished Siemens' advisory as ICSA-25-226-15, with the most recent republication update occurring on 2026-02-25 based on Siemens ProductCERT advisory SSA-613116. The advisory's revision history indicates corrections to affected product listings and removal of rejected CVEs in subsequent updates. Organizations should consult vendor guidance for patch availability and apply recommended mitigations for affected industrial control systems.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices with IPv6 enabled. Industrial control system operators relying on SINEC OS for network infrastructure. Security teams responsible for OT/ICS network availability and resilience.

Technical summary

The vulnerability resides in the IPv6 routing implementation (net/ipv6/route.c) of the Linux kernel prior to version 6.3. The max_size threshold for route cache entries can be exhausted through crafted IPv6 packet transmission via raw sockets in a loop. When this threshold is reached, the system generates 'network is unreachable' errors, effectively causing a denial of service condition. This affects IPv6 networking functionality and can disrupt connectivity on affected systems. Siemens industrial networking products running SINEC OS are impacted, requiring firmware updates to remediate the underlying kernel vulnerability.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-613116 for affected product versions and patch availability
  • Apply vendor-provided firmware updates for SINEC OS on affected RUGGEDCOM and SCALANCE devices
  • Implement network segmentation to limit exposure of IPv6-enabled industrial control systems
  • Monitor for anomalous IPv6 traffic patterns that may indicate exploitation attempts
  • Follow CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-25-226-15, which republishes Siemens ProductCERT advisory SSA-613116. Advisory revision history confirms publication date of 2025-08-12 and multiple updates through 2026-02-25. Siemens vendor identification and affected product list derived from CSAF product tree with high confidence.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-52340 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-52340

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-52340 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-52340

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.