PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-52655 Siemens CVE debrief

This CVE addresses a vulnerability in the Linux kernel's USB aqc111 driver. The fix involves adding a proper packet check for fixup operations to ensure true limit validation. The vulnerability was resolved in the Linux kernel, and Siemens has assessed this as 'Misinformed' impact for their affected industrial networking products, indicating the reported vulnerability does not actually affect these products as initially believed.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Linux systems with aqc111 USB Ethernet adapters should ensure kernel updates are applied. Industrial operators using affected Siemens networking equipment can disregard this CVE for their Siemens devices based on vendor assessment, but should maintain standard patch management practices.

Technical summary

The vulnerability exists in the Linux kernel's USB aqc111 driver, which handles Aquantia AQtion USB to 5GbE controllers. The fix implements proper packet validation for fixup operations by checking against true limits. This prevents potential out-of-bounds access or incorrect packet processing. Siemens has determined this vulnerability does not actually affect their listed industrial networking products (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family), marking the impact assessment as 'Misinformed' in their security advisory.

Defensive priority

low

Recommended defensive actions

  • Verify Linux kernel version on systems using aqc111 USB Ethernet adapters and apply relevant kernel updates
  • Review Siemens ProductCERT advisory SSA-613116 for definitive product impact assessment
  • For Siemens SCALANCE and RUGGEDCOM devices, confirm current firmware version against vendor guidance
  • Apply defense-in-depth practices for industrial control systems per CISA recommendations

Evidence notes

The source advisory (ICSA-25-226-15) explicitly marks the impact for affected Siemens products as 'Misinformed' in the threats section, indicating the vulnerability was incorrectly attributed to these products. The CVE description confirms this is a resolved Linux kernel USB driver issue. The advisory was republished on 2026-02-25 based on Siemens ProductCERT SSA-613116 advisory, with previous revisions correcting affected product lists and removing rejected CVEs.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-52655 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-52655

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-52655 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-52655

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.