PatchSiren cyber security CVE debrief

CVE-2024-36006 Siemens CVE debrief

A vulnerability in the Linux kernel's Mellanox switch driver (mlxsw) spectrum ACL TCAM component was resolved through a fix for incorrect list API usage. The issue, rated CVSS 3.1 5.5 (MEDIUM), could lead to local denial of service conditions. Siemens has identified this vulnerability as affecting certain industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. The vulnerability requires local access with low privileges and no user interaction to exploit. Siemens has released updates to address this issue in affected product lines.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, XCM-/XRM-/XCH-/XRH-300 family, or RUGGEDCOM RST2428P industrial switches in operational technology (OT) environments. Security teams responsible for industrial control system infrastructure and network administrators managing critical manufacturing or utility networks should prioritize patching.

Technical summary

The vulnerability exists in the mlxsw (Mellanox switch) driver's spectrum ACL TCAM implementation within the Linux kernel. Incorrect usage of kernel list APIs could result in memory corruption or list corruption leading to system instability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a local attack vector requiring low privileges, with high availability impact but no confidentiality or integrity impact. Affected Siemens products utilize this kernel component in their SINEC OS-based industrial Ethernet switches. The fix corrects the list API usage pattern to prevent the identified instability.

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided updates to SINEC OS V3.1 or later for affected SCALANCE and RUGGEDCOM devices
Review Siemens security advisory SSA-613116 for specific product update instructions
Implement network segmentation for industrial control systems per CISA recommended practices
Monitor for anomalous local access attempts on affected switch management interfaces
Validate that no unsupported SINEC OS versions remain in production environments

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. Source advisory ICSA-25-226-15 from CISA CSAF. Siemens ProductCERT SSA-613116 provides vendor remediation guidance. CVSS vector confirms local attack vector with availability impact.

Sources and references

Verified primary and authoritative sources

CVE-2024-36006 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-36006

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-36006 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36006

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.