PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26675 Siemens CVE debrief

A vulnerability in the Linux kernel's PPP asynchronous driver (ppp_async) allowed the Maximum Receive Unit (MRU) to exceed safe bounds, potentially enabling memory corruption or denial of service conditions. The issue was resolved by limiting MRU to 64KB. Siemens has identified this vulnerability as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. CISA republished Siemens' advisory with corrections to affected product listings in February 2026. No known exploitation in ransomware campaigns has been reported.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens SCALANCE XC/XR/XCM/XRM/XCH/XRH-series switches or RUGGEDCOM RST2428P devices in industrial networks, particularly those utilizing PPP-based serial or modem connections for remote access or WAN connectivity.

Technical summary

The Linux kernel's PPP asynchronous line discipline (ppp_async) did not properly limit the Maximum Receive Unit (MRU) parameter, which could lead to excessive memory allocation or buffer handling issues. The fix enforces a 64KB MRU limit. Siemens industrial networking products utilizing SINEC OS incorporate this kernel component and are affected. The vulnerability is classified with 'Misinformed' impact in CISA's CSAF data, suggesting potential for information disclosure or processing errors rather than direct code execution.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-613116 for definitive affected product and patch information
  • Verify SINEC OS version on deployed Siemens SCALANCE and RUGGEDCOM devices
  • Apply vendor-provided firmware updates when available per Siemens guidance
  • Monitor CISA ICS advisories for additional guidance on industrial control system security practices

Evidence notes

The vulnerability description indicates a kernel-level fix in ppp_async to limit MRU to 64K. Siemens ProductCERT advisory SSA-613116 is the authoritative source for affected product identification. CISA's CSAF advisory ICSA-25-226-15 was initially published 2025-08-12 and subsequently revised on 2026-02-12, 2026-02-24, and 2026-02-25 to correct product listings and remove rejected CVEs. The threat category in the source CSAF is marked as 'Misinformed' for affected product IDs.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26675 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26675

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26675 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26675

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.