PatchSiren cyber security CVE debrief

CVE-2024-37078 Siemens CVE debrief

CVE-2024-37078 is a kernel vulnerability in the nilfs2 filesystem affecting Siemens industrial networking products. The issue stems from a race condition where the log writer initiates writeback for segment summary blocks or super root blocks using the backing device's page cache without waiting for ongoing folio/page writeback operations to complete. This results in an inconsistent writeback state that could lead to data corruption or system instability. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. Siemens has assessed the impact as 'Misinformed' for affected products including the RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS. No CVSS score or severity rating has been assigned in the available sources. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices in industrial control system environments should assess their exposure to this kernel-level filesystem vulnerability.

Technical summary

The nilfs2 filesystem log writer fails to wait for ongoing folio/page writeback operations when initiating writeback for segment summary blocks or super root blocks. This race condition creates an inconsistent writeback state in the backing device's page cache. The vulnerability affects Siemens industrial networking products utilizing SINEC OS with the vulnerable nilfs2 implementation.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-355557 for detailed product-specific guidance
Verify SINEC OS and nilfs2 kernel patch levels on affected Siemens industrial networking equipment
Apply vendor-provided firmware updates when available for RUGGEDCOM RST2428P and SCALANCE X-family devices
Monitor CISA ICS advisories for updates to ICSA-25-226-07
Implement defense-in-depth strategies for industrial control systems per CISA recommended practices

Evidence notes

The vulnerability description is sourced from CISA ICS Advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The threat assessment of 'Misinformed' impact is explicitly stated in the CSAF source data. The CVE was republished by CISA on 2026-02-25 based on updated Siemens advisory information.

Sources and references

Verified primary and authoritative sources

CVE-2024-37078 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-37078

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-37078 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-37078

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.