PatchSiren cyber security CVE debrief

CVE-2024-27013 Siemens CVE debrief

A vulnerability in the Linux kernel's TUN/TAP driver could allow an attacker to cause a denial of service (DoS) condition through soft lockup. The issue occurs when the `vhost_worker` calls TUN callbacks to receive packets. If a high volume of illegal packets arrives, the `tun_do_read` function continuously dumps packet contents to the console. When console output is enabled, this excessive logging consumes significant CPU resources, potentially triggering a soft lockup detection. The vulnerability has been resolved by implementing the `net_ratelimit` mechanism to restrict the rate of packet content dumping. This is a local attack vector requiring low attack complexity and low privileges, with no impact to confidentiality or integrity, but high availability impact.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations running virtualized environments with TUN/TAP interfaces, particularly those using affected Siemens industrial networking equipment (SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family, and RUGGEDCOM RST2428P). System administrators managing KVM/QEMU virtualization hosts and industrial control system operators should prioritize patching.

Technical summary

The vulnerability exists in the Linux kernel's TUN (network tunnel) driver, specifically in how `tun_do_read` handles illegal packets. When `vhost_worker` invokes TUN callbacks for packet reception, malformed or illegal packets trigger verbose packet content dumping. Without rate limiting, sustained attack traffic causes excessive CPU consumption through console I/O operations, leading to soft lockup conditions. The fix implements `net_ratelimit` to throttle these diagnostic messages. CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (5.5 Medium).

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided updates to V3.1 or later version for affected Siemens SCALANCE and RUGGEDCOM products
Monitor system logs for excessive TUN-related console output that may indicate exploitation attempts
Implement network segmentation to limit exposure of TUN/TAP interfaces to untrusted networks
Review and restrict access to virtual machine interfaces using TUN/TAP devices
Consider disabling console output in production environments where not required for operations
Apply defense-in-depth strategies per ICS-CERT recommended practices for industrial control systems

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. Source advisory ICSA-25-226-15 from CISA CSAF, based on Siemens ProductCERT SSA-613116. Advisory revision history shows multiple updates through February 2026, with the latest republication on 2026-02-25 incorporating corrections to affected products list and removal of rejected CVEs.

Sources and references

Verified primary and authoritative sources

CVE-2024-27013 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-27013

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-27013 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-27013

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.