PatchSiren cyber security CVE debrief

CVE-2024-36901 Siemens CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 networking stack. The function ip6_dst_idev() may return NULL in ip6_output(), leading to a potential NULL dereference. This vulnerability was identified through syzbot automated kernel fuzzing. The issue affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. CISA published advisory ICSA-25-226-07 on August 12, 2025, with subsequent updates through February 25, 2026, to clarify affected product configurations and remove rejected CVEs from the advisory.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE X-family industrial Ethernet switches running SINEC OS should monitor this advisory. Network administrators responsible for IPv6-enabled industrial networks and security teams managing OT/ICS environments with Linux-based embedded systems should track vendor patch availability.

Technical summary

The vulnerability exists in the Linux kernel's IPv6 output path where ip6_dst_idev() may return NULL, leading to a NULL pointer dereference in ip6_output(). This is a classic defensive programming issue where a return value is not validated before use. The syzbot kernel fuzzer identified this code path as potentially exploitable. While the CVSS score of 5.5 indicates medium severity, the impact on industrial control systems may be elevated due to availability requirements. The advisory marks this CVE with 'Misinformed' impact status, suggesting potential discrepancies in initial severity assessment or affected product identification.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-355557 for definitive affected product and patch information
Verify SINEC OS version and installed kernel packages on affected Siemens industrial networking equipment
Apply vendor-provided firmware updates when available per Siemens ProductCERT guidance
Monitor CISA ICS advisories for updates to ICSA-25-226-07
Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

The source advisory (ICSA-25-226-07) indicates this CVE was initially included in a broader Siemens third-party components advisory but was subsequently marked as 'Misinformed' impact in the threats section. The February 2026 updates to the advisory removed multiple rejected CVEs and clarified affected product configurations, suggesting ongoing refinement of the vulnerability scope assessment.

Official resources

2025-08-12