PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36964 Siemens CVE debrief

A vulnerability in the Linux kernel's 9P filesystem implementation allows improper permission bit handling in plain 9P2000 protocol mode. The issue permits non-standard permission bits—including the setuid bit—to pass through validation when they should be filtered. This occurs because the code only explicitly handles Unix extended permission bits conditionally, while allowing unvalidated 'garbage' bits through for the base 9P2000 protocol. The vulnerability affects Siemens industrial networking products that incorporate the vulnerable kernel code, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS. Siemens has addressed this in SINEC OS V3.1 and later versions. CISA published this advisory on August 12, 2025, with subsequent updates through February 25, 2026 to correct affected product listings and incorporate the latest vendor guidance.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
NONE 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. System administrators managing Linux-based industrial control systems with 9P filesystem mounts. Security teams responsible for OT/ICS environment hardening and patch management.

Technical summary

The Linux kernel's fs/9p implementation fails to properly validate permission bits in plain 9P2000 protocol mode. While Unix extended permission bits (.u) are handled explicitly and conditionally, the base 9P2000 mode bits are passed through without proper sanitization. This allows 'garbage' bits—including security-sensitive flags like setuid—to be set on files, potentially enabling privilege escalation in environments where 9P filesystems are used. The vulnerability is resolved by restricting permission translation to standard RWX bits for plain 9P2000.

Defensive priority

medium

Recommended defensive actions

  • Review SINEC OS version on affected Siemens RUGGEDCOM RST2428P and SCALANCE X-family devices
  • Upgrade to SINEC OS V3.1 or later per vendor guidance
  • Verify 9P filesystem usage in operational environments and restrict if unnecessary
  • Apply network segmentation for industrial control systems per CISA recommended practices
  • Monitor for anomalous permission changes on 9P-mounted filesystems

Evidence notes

The vulnerability description indicates improper input validation (CWE-20) in the Linux kernel fs/9p subsystem, where plain 9P2000 permission bits are not properly sanitized. The CVSS vector provided in source materials (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N) suggests network attack vector with high complexity, though the base score calculates to 0.0 indicating informational severity in this context. Vendor remediation specifies update to V3.1 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36964 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36964

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36964 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36964

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.