PatchSiren cyber security CVE debrief

CVE-2024-27413 Siemens CVE debrief

A vulnerability in the Linux kernel's EFI capsule-loader subsystem, where an incorrect allocation size could lead to memory safety issues. The flaw was resolved by correcting the allocation size calculation in the capsule-loader code. Siemens has identified this vulnerability as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The vulnerability is classified as 'Misinformed' impact in the CISA advisory, indicating potential for information disclosure or integrity issues due to the memory allocation error.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens SCALANCE X-family switches (XC-300/XR-300/XC-400/XR-500WG/XR-500, XCM-/XRM-/XCH-/XRH-300 families) or RUGGEDCOM RST2428P devices with SINEC OS should prioritize this advisory. OT security teams, industrial network administrators, and asset owners in critical infrastructure sectors using affected Siemens networking equipment should monitor for vendor patches and implement compensating controls where patching is not immediately feasible.

Technical summary

The vulnerability exists in the Linux kernel's EFI capsule-loader driver, which is responsible for handling firmware update capsules in UEFI environments. An incorrect allocation size calculation could result in insufficient memory being allocated for capsule data structures, potentially leading to buffer overflows, information disclosure, or system instability during firmware update operations. The fix corrects the size calculation to ensure proper memory allocation. This kernel-level vulnerability affects Siemens industrial networking products that utilize the Linux kernel with EFI capsule-loader support for firmware management.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-613116 for affected product versions and patch availability
Apply vendor-provided firmware updates for affected SCALANCE and RUGGEDCOM devices when available
Verify SINEC OS version on affected devices and upgrade to patched versions per vendor guidance
Monitor CISA ICS advisories for additional updates to ICSA-25-226-15
Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

The vulnerability description indicates a memory allocation size error in the Linux kernel's EFI capsule-loader component. The fix involves correcting the allocation size calculation. Siemens ProductCERT advisory SSA-613116 (referenced in CISA ICSA-25-226-15) covers this vulnerability for affected SINEC OS-based products. The advisory was initially published 2025-08-12 and most recently updated 2026-02-25 to reflect republication based on the Siemens advisory.

Sources and references

Verified primary and authoritative sources

CVE-2024-27413 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-27413

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-27413 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-27413

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.