PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-12718 Siemens CVE debrief

The supplied advisory data ties CVE-2024-12718 to Siemens products and remediation guidance, while the CVE description itself says the issue affects Python 3.12+ tarfile extraction filters. In the source corpus, the issue is rated medium severity and the vendor remediation is to update affected Siemens products to V3.3 or later. CISA republished the advisory on 2026-02-25 after the initial 2026-01-28 publication.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-28
Original CVE updated
2026-02-25
Advisory published
2026-01-28
Advisory updated
2026-02-25

Who should care

Organizations running the Siemens products named in the advisory, especially teams responsible for firmware/software maintenance, and developers or platform teams using Python 3.12+ tarfile extraction on untrusted archives.

Technical summary

The CVSS vector is network-reachable with no privileges or user interaction and integrity impact only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The CVE description says TarFile.extractall() and TarFile.extract() can be abused when filter="data" or filter="tar" is used, allowing metadata changes (such as last-modified timestamps) or chmod changes on files outside the extraction directory. The description also states that only Python 3.12 or later are affected, and that Python 3.14 changes the default filter to "data". The Siemens CSAF remediation in the source corpus is to update affected products to V3.3 or later.

Defensive priority

Medium: the issue is integrity-focused and not a full code-execution vulnerability in the provided description, but the exposure is network-reachable and the source corpus includes vendor remediation for multiple Siemens product lines.

Recommended defensive actions

  • Identify whether any Siemens products listed in the advisory are deployed and compare them against the vendor remediation guidance.
  • Update affected Siemens products to V3.3 or later using the Siemens support notice referenced by CISA.
  • If you use Python tarfile extraction on untrusted archives, avoid relying on filter="data" or filter="tar" for security and validate archive contents before extraction.
  • Review source-distribution installation workflows for suspicious links before installing tar-based source packages.
  • Track the Siemens and CISA advisory pages for any further scope clarification or additional remediation notes.

Evidence notes

The source corpus contains an apparent scope inconsistency: the CVE narrative is about Python tarfile extraction filters, while the CSAF advisory metadata and remediation entries are for Siemens products. This debrief reflects both parts of the supplied corpus and avoids assuming which product scope is definitive beyond the cited sources. Timing context used here is taken from the supplied source dates: published 2026-01-28 and modified 2026-02-25.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-12718 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-12718

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-12718 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-12718

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-089022.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-089022.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.