PatchSiren cyber security CVE debrief

CVE-2024-36964 Siemens CVE debrief

A vulnerability in the Linux kernel's 9P filesystem implementation allows improper permission bit handling in plain 9P2000 protocol mode. The issue permits non-standard permission bits—including the setuid bit—to pass through validation when they should be filtered. This occurs because the code only explicitly handles Unix extended permission bits conditionally, while allowing unvalidated 'garbage' bits through for the base 9P2000 protocol. The vulnerability affects Siemens industrial networking products that incorporate the vulnerable kernel code, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS. Siemens has addressed this in SINEC OS V3.1 and later versions. CISA published this advisory on August 12, 2025, with subsequent updates through February 25, 2026 to correct affected product listings and incorporate the latest vendor guidance.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: NONE
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. System administrators managing Linux-based industrial control systems with 9P filesystem mounts. Security teams responsible for OT/ICS environment hardening and patch management.

Technical summary

The Linux kernel's fs/9p implementation fails to properly validate permission bits in plain 9P2000 protocol mode. While Unix extended permission bits (.u) are handled explicitly and conditionally, the base 9P2000 mode bits are passed through without proper sanitization. This allows 'garbage' bits—including security-sensitive flags like setuid—to be set on files, potentially enabling privilege escalation in environments where 9P filesystems are used. The vulnerability is resolved by restricting permission translation to standard RWX bits for plain 9P2000.

Defensive priority

medium

Recommended defensive actions

Review SINEC OS version on affected Siemens RUGGEDCOM RST2428P and SCALANCE X-family devices
Upgrade to SINEC OS V3.1 or later per vendor guidance
Verify 9P filesystem usage in operational environments and restrict if unnecessary
Apply network segmentation for industrial control systems per CISA recommended practices
Monitor for anomalous permission changes on 9P-mounted filesystems

Evidence notes

The vulnerability description indicates improper input validation (CWE-20) in the Linux kernel fs/9p subsystem, where plain 9P2000 permission bits are not properly sanitized. The CVSS vector provided in source materials (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N) suggests network attack vector with high complexity, though the base score calculates to 0.0 indicating informational severity in this context. Vendor remediation specifies update to V3.1 or later.

Official resources

2025-08-12