PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-52478 Siemens CVE debrief

A vulnerability in the Linux kernel's HID Logitech HID++ driver could cause a kernel crash when a Logitech receiver is disconnected via USB. The issue stems from improper handling of USB disconnect events in the hid-logitech-hidpp driver, potentially leading to a use-after-free or null pointer dereference condition. Siemens has assessed this vulnerability as affecting certain industrial networking products that incorporate the vulnerable Linux kernel component, specifically the RUGGEDCOM RST2428P and SCALANCE X family devices running SINEC OS. The vulnerability was originally resolved in the upstream Linux kernel, and Siemens has incorporated this fix into affected product lines. The CISA advisory ICSA-25-226-15, republished on 2026-02-25, provides authoritative guidance based on Siemens ProductCERT advisory SSA-613116. No known exploitation in the wild has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family and XCM-/XRM-/XCH-/XRH-300 family devices in industrial control system environments. System administrators responsible for Linux-based embedded systems using Logitech HID++ devices. Security teams monitoring for local denial-of-service vectors in critical infrastructure environments where physical access controls may be a concern.

Technical summary

The vulnerability exists in the Linux kernel's HID Logitech HID++ driver (drivers/hid/hid-logitech-hidpp.c), which handles communication with Logitech's HID++ protocol devices. When a Logitech USB receiver is physically disconnected, improper cleanup of driver state can trigger a kernel crash. This represents a local denial-of-service condition requiring physical access to the system. The fix involves proper synchronization and cleanup of driver resources during USB disconnect handling. Siemens industrial networking products incorporating this kernel component are affected, with remediation available through vendor firmware updates.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-613116 for specific affected product versions and patch availability
  • Apply vendor-provided firmware updates for RUGGEDCOM RST2428P and SCALANCE X family devices as indicated in Siemens security advisory
  • For systems where patching is not immediately feasible, restrict physical access to USB ports to prevent unauthorized Logitech receiver connections and disconnections
  • Monitor system logs for unexpected kernel panics or crashes that may indicate exploitation attempts
  • Follow CISA ICS recommended practices for defense-in-depth strategies in industrial control system environments

Evidence notes

The vulnerability description indicates a kernel crash on USB disconnect of Logitech receivers, resolved in the Linux kernel HID: logitech-hidpp driver. Siemens ProductCERT advisory SSA-613116 is the authoritative source for affected product identification. CISA advisory ICSA-25-226-15 was initially published 2025-08-12 and republished 2026-02-25 with corrections to affected products list. The threat assessment in the source marks impact as 'Misinformed' for affected product IDs CSAFPID-0001, CSAFPID-0004, and CSAFPID-0003. No CVSS score is provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-52478 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-52478

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-52478 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-52478

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.