PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-39487 Siemens CVE debrief

CVE-2024-39487 is a medium-severity out-of-bounds read vulnerability in the Linux kernel's bonding driver, specifically within the `bond_option_arp_ip_targets_set()` function. The vulnerability was resolved in the Linux kernel, indicating a patch is available upstream. Siemens has assessed this CVE as affecting certain industrial networking products, including the RUGGEDCOM RST2428P and SCALANCE families, though the specific impact categorization in the source advisory is marked as 'Misinformed' for the tracked product IDs. The CVE was published on August 12, 2025, with subsequent modifications through February 25, 2026, including corrections to affected product listings and advisory republication based on Siemens ProductCERT guidance. Organizations running affected Siemens industrial control systems should consult vendor security advisories for patch availability and apply recommended mitigations following defense-in-depth practices for ICS environments.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices in industrial control system environments. Network administrators managing bonded network interfaces on Linux-based industrial equipment. Security teams responsible for OT/ICS vulnerability management and patch coordination.

Technical summary

The vulnerability exists in the Linux kernel's bonding driver within `bond_option_arp_ip_targets_set()`, where an out-of-bounds read condition could occur during ARP IP target configuration. This function handles setting IP addresses used for ARP monitoring in network bonding configurations. The out-of-bounds read suggests insufficient bounds checking when processing user-supplied ARP target parameters, potentially leading to information disclosure or denial of service conditions. The fix was committed to the Linux kernel upstream. Siemens industrial networking products incorporating affected kernel versions are impacted, with vendor security advisories providing product-specific remediation guidance.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for detailed product-specific impact and patch guidance
  • Verify kernel version on affected Siemens RUGGEDCOM and SCALANCE devices against vendor security bulletins
  • Apply vendor-provided firmware updates when available, prioritizing internet-facing or critical infrastructure deployments
  • Implement network segmentation for industrial control systems per CISA ICS recommended practices
  • Monitor for anomalous network behavior on bonded interface configurations pending patch application

Evidence notes

The source CISA CSAF advisory (ICSA-25-226-07) tracks this CVE with threat category 'impact' marked as 'Misinformed' for product IDs CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003. The advisory underwent four revision cycles, with the most significant update on 2026-02-25 republicating based on Siemens ProductCERT SSA-355557. The Linux kernel fix description indicates resolution of an out-of-bounds read condition in bonding driver ARP target configuration.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-39487 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-39487

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-39487 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-39487

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.