PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-52604 Siemens CVE debrief

CVE-2023-52604 is a Linux kernel vulnerability in the JFS (Journaled File System) implementation, specifically an array-index-out-of-bounds issue in the dbAdjTree function detected by UBSAN (Undefined Behavior Sanitizer). The vulnerability has been resolved in the Linux kernel. Siemens has identified this CVE as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The CISA advisory ICSA-25-226-15, published on 2025-08-12 and most recently updated on 2026-02-25, tracks this vulnerability. The advisory underwent multiple revisions, including corrections to affected product lists and removal of rejected CVEs. Siemens has rated the impact as 'Misinformed' for the affected products. Organizations should consult Siemens ProductCERT advisory SSA-613116 for specific patch and mitigation guidance.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family switches with SINEC OS. Industrial control system operators using JFS filesystems on Linux-based embedded systems. Critical infrastructure entities following CISA ICS advisory guidance.

Technical summary

The vulnerability exists in the JFS (Journaled File System) implementation within the Linux kernel, specifically in the dbAdjTree function. An array-index-out-of-bounds condition was detected by UBSAN (Undefined Behavior Sanitizer), indicating potential memory safety issues when handling JFS filesystem structures. The vulnerability has been resolved in the Linux kernel. Siemens industrial networking products running SINEC OS incorporate the affected kernel component, exposing these devices to the underlying issue. The CISA advisory classifies impact as 'Misinformed' for affected Siemens products.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-613116 for affected product versions and patch availability
  • Apply vendor-provided firmware updates for SINEC OS-based devices when available
  • Verify JFS filesystem usage on affected industrial control systems and assess exposure
  • Follow CISA ICS recommended practices for defense-in-depth strategies
  • Monitor CISA ICSA-25-226-15 for advisory updates

Evidence notes

CVE published 2025-08-12 per CISA CSAF source. Modified 2026-02-25. Source indicates vulnerability resolved in Linux kernel. Siemens ProductCERT SSA-613116 is the canonical vendor advisory. Impact rated as 'Misinformed' in CISA CSAF threats section. Not listed in CISA KEV catalog.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-52604 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-52604

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-52604 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-52604

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.