PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40941 Siemens CVE debrief

CVE-2024-40941 is an out-of-bounds read vulnerability in the Intel Wireless (iwlwifi) driver for Linux, specifically in the mvm (Multi-Virtual-Machine) component. The flaw occurs when the firmware sends a notification claiming more data than is actually present, causing the driver to read past the allocated buffer for the mfuart notification. While this vulnerability originates in the Linux kernel's WiFi subsystem, it has been identified as affecting Siemens industrial networking products that incorporate the vulnerable third-party component. The CISA ICS advisory (ICSA-25-226-07) and Siemens ProductCERT advisory SSA-355557 track this issue for affected industrial control systems. Notably, the advisory's threat assessment categorizes the impact for specific product IDs as 'Misinformed,' suggesting potential clarification or correction in the vulnerability's applicability to certain configurations. The advisory was initially published on August 12, 2025, and underwent multiple revisions through February 2026, including corrections to affected product lists and removal of rejected CVEs. Organizations operating Siemens SCALANCE and RUGGEDCOM devices should consult vendor guidance to determine actual exposure and apply appropriate mitigations.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 4.1
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly those deploying SCALANCE wireless switches or RUGGEDCOM devices in critical infrastructure environments. Security teams responsible for OT/ICS asset management, vulnerability management programs covering third-party components in industrial products, and network administrators managing wireless industrial networks should prioritize verification of exposure.

Technical summary

The vulnerability exists in the mvm (Multi-Virtual-Machine) component of the Intel Wireless Linux driver (iwlwifi). When processing mfuart notifications from firmware, the driver fails to validate the claimed data length against the actual allocated buffer size. A malicious or compromised firmware could send a notification with an inflated length field, causing the driver to perform an out-of-bounds read beyond the notification buffer boundary. This represents a classic trusted input validation failure where firmware-supplied metadata is not adequately sanitized before use in memory access operations. The vulnerability is classified under CWE-125 (Out-of-bounds Read).

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 to confirm affected product configurations and firmware versions
  • Verify whether deployed SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family, or RUGGEDCOM RST2428P devices incorporate the vulnerable iwlwifi component
  • Apply vendor-provided firmware updates or patches when available
  • For devices confirmed not affected, document rationale based on vendor guidance
  • Implement network segmentation for industrial wireless infrastructure to limit potential attack exposure
  • Monitor CISA ICS advisories for updates to ICSA-25-226-07

Evidence notes

Vulnerability description derived from CVE text and CISA CSAF source. Vendor attribution to Siemens confirmed via csaf_product_tree evidence with high confidence. Threat impact categorization of 'Misinformed' noted for product IDs CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003 per source threats array. Advisory revision history shows four updates, with the most recent on 2026-02-25 for CISA republication based on Siemens ProductCERT SSA-355557.

Official resources

2025-08-12