PatchSiren cyber security CVE debrief

CVE-2024-27405 Siemens CVE debrief

CVE-2024-27405 is a vulnerability in the Linux kernel's USB gadget NCM (Network Control Model) subsystem. The issue involves improper handling of datagrams within properly parsed NTBs (NCM Transfer Blocks), which could result in data loss or communication failures in USB networking implementations. The vulnerability was resolved by ensuring datagrams are not dropped when NTBs are correctly parsed. Siemens has identified this vulnerability as affecting certain industrial networking products, including the RUGGEDCOM RST2428P and SCALANCE X-family devices running SINEC OS. The CISA advisory ICSA-25-226-15, published on August 12, 2025, and subsequently updated through February 25, 2026, provides coordinated disclosure for this issue. The advisory underwent multiple revisions to correct affected product listings and remove rejected CVEs. Siemens has assessed the impact of this vulnerability as 'Misinformed' for the affected products. Organizations operating the identified Siemens industrial networking equipment should consult the vendor's security advisory for specific patch availability and deployment guidance.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly those with RUGGEDCOM RST2428P or SCALANCE X-family devices in USB networking configurations. OT security teams responsible for patch management in industrial environments. Network administrators managing SINEC OS deployments should prioritize vendor guidance.

Technical summary

The vulnerability exists in the USB gadget NCM driver within the Linux kernel. The NCM (Network Control Model) is a USB class protocol for Ethernet networking over USB. The specific flaw caused properly parsed NTBs (NCM Transfer Blocks) to incorrectly drop contained datagrams, potentially disrupting USB-based network communications. The fix ensures datagrams are preserved when NTBs are successfully parsed. This vulnerability affects Siemens industrial networking products that utilize the Linux kernel's USB gadget subsystem with NCM functionality, specifically devices running SINEC OS including the RUGGEDCOM RST2428P and various SCALANCE X-family switches.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-613116 for detailed product-specific patch information and affected version ranges
Verify SINEC OS version on SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family and RUGGEDCOM RST2428P devices
Apply vendor-provided firmware updates when available per organizational change management procedures
Monitor CISA ICS advisories for additional guidance on industrial control system security practices
Implement network segmentation for industrial control systems to limit exposure of vulnerable USB gadget implementations

Evidence notes

The vulnerability description is sourced from the Linux kernel commit message indicating a resolution for datagram dropping in USB gadget NCM. Siemens ProductCERT advisory SSA-613116 is the authoritative source for product-specific impact assessment. CISA's ICSA-25-226-15 serves as the coordinating advisory, with revision history showing ongoing refinement of affected product scope from August 2025 through February 2026.

Sources and references

Verified primary and authoritative sources

CVE-2024-27405 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-27405

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-27405 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-27405

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.