PatchSiren cyber security CVE debrief

CVE-2023-52864 Siemens CVE debrief

CVE-2023-52864 is a vulnerability in the Linux kernel's Windows Management Instrumentation (WMI) platform/x86 driver, specifically affecting the opening of a character device. The vulnerability was resolved in the Linux kernel with a fix for improper handling of the WMI char device open operation. Siemens has identified this CVE as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The CISA advisory ICSA-25-226-15, published August 12, 2025, and subsequently updated through February 25, 2026, tracks this vulnerability as part of a broader Siemens security advisory (SSA-613116). Notably, the threat assessment in the source CSAF data categorizes the impact as 'Misinformed,' suggesting potential information disclosure or confusion in device state rather than direct code execution. No CVSS score is currently assigned in the available sources. Organizations operating affected Siemens industrial networking equipment should consult the vendor's security advisory for patch availability and apply updates according to their maintenance windows.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly those using RUGGEDCOM RST2428P switches or SCALANCE X-family managed switches in critical infrastructure, manufacturing, or utility environments. Security teams responsible for industrial control system (ICS) asset management and vulnerability response should prioritize this advisory. System integrators and OT/IT convergence teams managing SINEC OS deployments should review patch applicability. CISOs and risk managers in sectors with NERC CIP, IEC 62443, or similar industrial cybersecurity compliance requirements should ensure vulnerability management processes address this kernel-level exposure in embedded networking equipment.

Technical summary

CVE-2023-52864 addresses a vulnerability in the Linux kernel's platform/x86 WMI (Windows Management Instrumentation) subsystem, specifically in the handling of character device open operations. The vulnerability was resolved with a kernel patch that corrects the device opening behavior. Siemens has determined that this kernel-level issue affects certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P (6GK6242-6PA00) and multiple SCALANCE X-family switch product lines (XC-300/XR-300/XC-400/XR-500WG/XR-500 family, XCM-/XRM-/XCH-/XRH-300 family). The CSAF threat classification of 'Misinformed' suggests the vulnerability may lead to information disclosure or state confusion rather than arbitrary code execution. The advisory history shows iterative refinement of affected product lists, with corrections made in February 2026 to accurately reflect the vulnerability scope. Organizations should prioritize firmware updates on affected devices, particularly those deployed in critical infrastructure environments where the SCALANCE and RUGGEDCOM product families are commonly used for industrial network infrastructure.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-613116 for detailed product-specific patch information and affected version ranges
Verify SINEC OS version on deployed RUGGEDCOM RST2428P and SCALANCE X-family devices against vendor guidance
Apply vendor-provided firmware updates to affected industrial networking equipment per organizational change management procedures
Monitor CISA ICS advisories for additional guidance on industrial control system security practices
Implement network segmentation for industrial control systems to limit exposure of vulnerable devices
Follow CISA recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

The vulnerability description indicates a kernel-level issue in the WMI platform/x86 subsystem related to character device opening. The CISA CSAF source (ICSA-25-226-15) marks the threat impact as 'Misinformed' for affected product IDs. The advisory has undergone multiple revisions, with the most recent update on February 25, 2026, reflecting ongoing vendor coordination. Siemens ProductCERT advisory SSA-613116 is the canonical vendor source.

Official resources

2025-08-12