PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-42070 Siemens CVE debrief

CVE-2024-42070 is a vulnerability in the Linux kernel's netfilter nf_tables subsystem affecting Siemens industrial networking products. The flaw involves incomplete validation of NFT_DATA_VALUE during register store operations, which could allow pointer leakage to chain objects through data registers. The vulnerability stems from conditional validation logic that fails to consistently verify register types when storing NFT_DATA_VALUE, potentially enabling information disclosure or system instability. Siemens has addressed this in SINEC OS V3.1 and later versions. The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector with low attack complexity, requiring low privileges but no user interaction, with high availability impact. CISA republished this advisory on February 25, 2026, based on updated Siemens ProductCERT guidance.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. System administrators managing nftables configurations in embedded Linux environments. OT security teams responsible for patch management in industrial control system networks. Organizations subject to NERC CIP or IEC 62443 compliance requirements for critical infrastructure.

Technical summary

The vulnerability exists in the Linux kernel's netfilter nf_tables subsystem where register store validation for NFT_DATA_VALUE is performed conditionally rather than consistently. The datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT, but the validation logic fails to properly infer register types from set datatypes. This allows a pointer to chain objects to leak through registers when NFT_DATA_VALUE is stored without full validation. The fix implements a helper function to infer register type from set datatype, removing the conditional check and ensuring consistent validation. Affected Siemens products use SINEC OS with vulnerable kernel versions prior to V3.1.

Defensive priority

medium

Recommended defensive actions

  • Update affected Siemens devices to SINEC OS V3.1 or later version
  • Review and apply vendor security advisory SSA-613116 guidance
  • Implement network segmentation for industrial control systems per CISA recommended practices
  • Monitor for anomalous nf_tables behavior or unexpected register state changes
  • Validate nftables rule configurations for proper data type handling

Evidence notes

Vulnerability confirmed in Siemens SINEC OS affecting RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. Root cause is incomplete validation of NFT_DATA_VALUE in nf_tables register store operations. Vendor fix available in V3.1 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-42070 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-42070

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-42070 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-42070

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.