PatchSiren cyber security CVE debrief

CVE-2024-35996 Siemens CVE debrief

CVE-2024-35996 addresses a Linux kernel issue where CPU mitigations were not enabled by default on non-x86 architectures, potentially leaving systems vulnerable to speculative execution attacks. The vulnerability stems from the kernel's CPU mitigation framework defaulting to disabled states on architectures other than x86, contrary to security best practices. Siemens has identified this as affecting SINEC OS, which powers industrial networking equipment including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a local attack vector with low complexity, requiring low privileges and no user interaction, resulting in high availability impact but no confidentiality or integrity impact. This suggests the vulnerability could allow a local attacker to cause denial-of-service conditions on affected industrial control systems. The advisory was initially published by CISA on August 12, 2025, with subsequent revisions through February 2026 to correct affected product listings and remove rejected CVEs. Siemens has provided a vendor fix requiring update to SINEC OS V3.1 or later.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment with SINEC OS, particularly those deploying RUGGEDCOM and SCALANCE products in critical infrastructure environments. Security teams responsible for OT/ICS asset management and patch deployment should prioritize verification of SINEC OS versions and mitigation status.

Technical summary

The Linux kernel's CPU mitigation framework historically defaulted to disabled on non-x86 architectures, requiring explicit enablement. CVE-2024-35996 corrects this by re-enabling CPU mitigations by default for !X86 architectures. In Siemens SINEC OS deployments, this vulnerability affects industrial networking equipment including RUGGEDCOM RST2428P and SCALANCE X-family switches (XC-300/XR-300/XC-400/XR-500WG/XR-500, XCM-/XRM-/XCH-/XRH-300 families). The local attack vector with high availability impact suggests potential for denial-of-service through exploitation of unmitigated speculative execution vulnerabilities on affected ARM or other non-x86 platforms.

Defensive priority

medium

Recommended defensive actions

Update affected Siemens SINEC OS devices to version 3.1 or later to obtain the vendor fix for CVE-2024-35996
Verify CPU mitigation status on non-x86 architecture systems running SINEC OS prior to V3.1
Review local access controls on affected industrial networking equipment to limit potential exploitation
Monitor Siemens ProductCERT advisory SSA-613116 for additional product-specific guidance
Apply defense-in-depth strategies per CISA ICS recommended practices for industrial control systems

Evidence notes

CVE description and CVSS vector from CISA CSAF advisory ICSA-25-226-15. Affected products and remediation details from Siemens ProductCERT SSA-613116 as republished by CISA. Timeline derived from advisory revision history showing initial publication 2025-08-12 and final republication 2026-02-25.

Sources and references

Verified primary and authoritative sources

CVE-2024-35996 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-35996

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-35996 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-35996

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.