PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-52502 Siemens CVE debrief

A race condition vulnerability exists in the Linux kernel's Near Field Communication (NFC) subsystem, specifically within the `nfc_llcp_sock_get()` and `nfc_llcp_sock_get_sn()` functions. The vulnerability was resolved in the Linux kernel with fixes to address race conditions in these socket lookup functions. Siemens has assessed this CVE as applicable to certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The CISA ICS advisory ICSA-25-226-15, published August 12, 2025, and subsequently updated through February 25, 2026, tracks this vulnerability for affected Siemens industrial control systems. The advisory's threat assessment categorizes the impact as 'Misinformed' for the listed product IDs. Organizations operating affected Siemens industrial networking equipment should consult the vendor's security advisory for specific patch guidance and affected version information.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly RUGGEDCOM and SCALANCE X-family switches running SINEC OS. Security teams responsible for industrial control system (ICS) environments using NFC-capable Linux-based embedded systems. Asset owners in critical infrastructure sectors deploying affected Siemens networking equipment.

Technical summary

The vulnerability involves race conditions in the Linux kernel's NFC (Near Field Communication) Logical Link Control Protocol (LLCP) socket lookup functions `nfc_llcp_sock_get()` and `nfc_llcp_sock_get_sn()`. Race conditions in these functions could potentially lead to use-after-free or null pointer dereference scenarios during socket retrieval operations. The fix implemented in the Linux kernel addresses these synchronization issues. Siemens has identified this vulnerability as affecting industrial networking products utilizing SINEC OS, including RUGGEDCOM RST2428P and multiple SCALANCE X-family product lines. The CISA advisory ICSA-25-226-15, with multiple revisions through February 2026, provides tracking for this vulnerability in the industrial control systems context.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-613116 for affected product versions and patch availability
  • Apply vendor-provided firmware updates for SINEC OS-based devices when available
  • Assess NFC subsystem exposure on affected industrial networking equipment
  • Monitor CISA ICS advisories for additional guidance on ICSA-25-226-15
  • Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

CVE published 2025-08-12 per CISA CSAF source. Linux kernel fix description indicates race condition in NFC LLCP socket functions. Siemens ProductCERT SSA-613116 and CISA ICSA-25-226-15 provide vendor advisory context. Threat category 'Misinformed' assigned in source CSAF data.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-52502 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-52502

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-52502 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-52502

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.