PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26720 Siemens CVE debrief

A divide-by-zero vulnerability in the Linux kernel's writeback code (mm/writeback) was resolved in kernel development. The flaw existed in the wb_dirty_limits() function. Siemens has assessed this CVE as **Misinformed** for affected industrial networking products (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family) per CISA advisory ICSA-25-226-15. The CVE was published on 2025-08-12 and last modified on 2026-02-25. This CVE is **not** listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Operators of Siemens SCALANCE and RUGGEDCOM industrial networking equipment; security teams tracking Linux kernel vulnerabilities in embedded/OT environments

Technical summary

The vulnerability involves a divide-by-zero condition in wb_dirty_limits(), a function in the Linux kernel's memory management writeback subsystem. This function calculates dirty page limits for writeback control. A divide-by-zero could cause kernel instability. However, Siemens has assessed this CVE as 'Misinformed' for their affected product lines, indicating the vulnerability either does not affect these products or the initial impact assessment was incorrect. The underlying kernel fix was applied upstream.

Defensive priority

low

Recommended defensive actions

  • Verify SCALANCE/RUGGEDCOM device firmware versions against Siemens ProductCERT SSA-613116 guidance
  • Monitor Siemens ProductCERT and CISA ICS advisories for updated impact assessments
  • Apply standard ICS defense-in-depth practices per CISA recommended practices for industrial control systems

Evidence notes

Siemens ProductCERT SSA-613116 advisory, republished by CISA as ICSA-25-226-15. The threat assessment category 'impact' with details 'Misinformed' indicates Siemens determined this CVE does not affect the listed products as originally reported, or the impact assessment was corrected. The advisory underwent multiple revisions, with the most recent on 2026-02-25 removing rejected CVEs and updating affected product lists.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26720 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26720

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26720 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26720

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.