PatchSiren cyber security CVE debrief

CVE-2023-52655 Siemens CVE debrief

This CVE addresses a vulnerability in the Linux kernel's USB aqc111 driver. The fix involves adding a proper packet check for fixup operations to ensure true limit validation. The vulnerability was resolved in the Linux kernel, and Siemens has assessed this as 'Misinformed' impact for their affected industrial networking products, indicating the reported vulnerability does not actually affect these products as initially believed.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations running Linux systems with aqc111 USB Ethernet adapters should ensure kernel updates are applied. Industrial operators using affected Siemens networking equipment can disregard this CVE for their Siemens devices based on vendor assessment, but should maintain standard patch management practices.

Technical summary

The vulnerability exists in the Linux kernel's USB aqc111 driver, which handles Aquantia AQtion USB to 5GbE controllers. The fix implements proper packet validation for fixup operations by checking against true limits. This prevents potential out-of-bounds access or incorrect packet processing. Siemens has determined this vulnerability does not actually affect their listed industrial networking products (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family), marking the impact assessment as 'Misinformed' in their security advisory.

Defensive priority

low

Recommended defensive actions

Verify Linux kernel version on systems using aqc111 USB Ethernet adapters and apply relevant kernel updates
Review Siemens ProductCERT advisory SSA-613116 for definitive product impact assessment
For Siemens SCALANCE and RUGGEDCOM devices, confirm current firmware version against vendor guidance
Apply defense-in-depth practices for industrial control systems per CISA recommendations

Evidence notes

The source advisory (ICSA-25-226-15) explicitly marks the impact for affected Siemens products as 'Misinformed' in the threats section, indicating the vulnerability was incorrectly attributed to these products. The CVE description confirms this is a resolved Linux kernel USB driver issue. The advisory was republished on 2026-02-25 based on Siemens ProductCERT SSA-613116 advisory, with previous revisions correcting affected product lists and removing rejected CVEs.

Official resources

2025-08-12