PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36901 Siemens CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 networking stack. The function ip6_dst_idev() may return NULL in ip6_output(), leading to a potential NULL dereference. This vulnerability was identified through syzbot automated kernel fuzzing. The issue affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. CISA published advisory ICSA-25-226-07 on August 12, 2025, with subsequent updates through February 25, 2026, to clarify affected product configurations and remove rejected CVEs from the advisory.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE X-family industrial Ethernet switches running SINEC OS should monitor this advisory. Network administrators responsible for IPv6-enabled industrial networks and security teams managing OT/ICS environments with Linux-based embedded systems should track vendor patch availability.

Technical summary

The vulnerability exists in the Linux kernel's IPv6 output path where ip6_dst_idev() may return NULL, leading to a NULL pointer dereference in ip6_output(). This is a classic defensive programming issue where a return value is not validated before use. The syzbot kernel fuzzer identified this code path as potentially exploitable. While the CVSS score of 5.5 indicates medium severity, the impact on industrial control systems may be elevated due to availability requirements. The advisory marks this CVE with 'Misinformed' impact status, suggesting potential discrepancies in initial severity assessment or affected product identification.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for definitive affected product and patch information
  • Verify SINEC OS version and installed kernel packages on affected Siemens industrial networking equipment
  • Apply vendor-provided firmware updates when available per Siemens ProductCERT guidance
  • Monitor CISA ICS advisories for updates to ICSA-25-226-07
  • Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

The source advisory (ICSA-25-226-07) indicates this CVE was initially included in a broader Siemens third-party components advisory but was subsequently marked as 'Misinformed' impact in the threats section. The February 2026 updates to the advisory removed multiple rejected CVEs and clarified affected product configurations, suggesting ongoing refinement of the vulnerability scope assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36901 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36901

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36901 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36901

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.