PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-52817 Siemens CVE debrief

A null pointer dereference vulnerability in the Linux kernel's AMDGPU DRM driver, specifically in the `smc_rreg` pointer handling, has been identified and resolved. The vulnerability could allow an attacker to trigger a kernel crash through null pointer access when the `smc_rreg` function pointer is NULL. This affects Siemens industrial networking products that incorporate the vulnerable Linux kernel components, including RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS. The issue was disclosed in CISA advisory ICSA-25-226-15, which was initially published on August 12, 2025, and subsequently updated on February 25, 2026, to reflect corrections to affected product listings based on Siemens ProductCERT advisory SSA-613116. The vulnerability is classified as 'Misinformed' in the threat assessment, indicating potential for information disclosure or system instability rather than direct code execution. Organizations should apply vendor-provided firmware updates for affected SCALANCE and RUGGEDCOM devices and follow CISA's ICS recommended practices for defense-in-depth strategies.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens SCALANCE X-family industrial Ethernet switches (XC-300/XR-300/XC-400/XR-500WG/XR-500, XCM-/XRM-/XCH-/XRH-300) and RUGGEDCOM RST2428P devices in industrial control system (ICS) environments. System administrators responsible for OT/ICS network infrastructure, security teams managing critical infrastructure, and compliance officers overseeing NERC CIP or similar industrial cybersecurity frameworks should prioritize assessment and patching.

Technical summary

The vulnerability exists in the AMDGPU (AMD GPU) Direct Rendering Manager (DRM) driver within the Linux kernel. The `smc_rreg` pointer, used for reading registers from the System Management Controller (SMC), can be NULL under certain conditions, leading to a null pointer dereference when accessed. This is a classic memory safety issue that results in kernel oops or panic, causing denial of service. The fix ensures proper null pointer checks before dereferencing `smc_rreg`. Affected Siemens products incorporate this vulnerable kernel component in their SINEC OS firmware for industrial Ethernet switches.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates for affected Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family, and RUGGEDCOM RST2428P devices as specified in Siemens ProductCERT
  • Implement network segmentation for industrial control systems to limit exposure of affected devices
  • Monitor for anomalous system behavior or unexpected crashes on affected devices
  • Follow CISA's ICS recommended practices for defense-in-depth cybersecurity strategies
  • Review and update incident response procedures for industrial control system environments

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-25-226-15. The advisory underwent multiple revisions: initial publication (2025-08-12), correction of affected products (2026-02-12), removal of rejected CVEs and unsupported version notes (2026-02-24), and final republication based on Siemens SSA-613116 (2026-02-25). The threat category is explicitly marked as 'Misinformed' with impact on products CSAFPID-0001, CSAFPID-0003, and CSAFPID-0004.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-52817 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-52817

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-52817 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-52817

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.