PatchSiren cyber security CVE debrief

CVE-2024-42070 Siemens CVE debrief

CVE-2024-42070 is a vulnerability in the Linux kernel's netfilter nf_tables subsystem affecting Siemens industrial networking products. The flaw involves incomplete validation of NFT_DATA_VALUE during register store operations, which could allow pointer leakage to chain objects through data registers. The vulnerability stems from conditional validation logic that fails to consistently verify register types when storing NFT_DATA_VALUE, potentially enabling information disclosure or system instability. Siemens has addressed this in SINEC OS V3.1 and later versions. The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector with low attack complexity, requiring low privileges but no user interaction, with high availability impact. CISA republished this advisory on February 25, 2026, based on updated Siemens ProductCERT guidance.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-09
Original CVE updated: 2026-05-14
Advisory published: 2024-04-09
Advisory updated: 2026-05-14

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. System administrators managing nftables configurations in embedded Linux environments. OT security teams responsible for patch management in industrial control system networks. Organizations subject to NERC CIP or IEC 62443 compliance requirements for critical infrastructure.

Technical summary

The vulnerability exists in the Linux kernel's netfilter nf_tables subsystem where register store validation for NFT_DATA_VALUE is performed conditionally rather than consistently. The datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT, but the validation logic fails to properly infer register types from set datatypes. This allows a pointer to chain objects to leak through registers when NFT_DATA_VALUE is stored without full validation. The fix implements a helper function to infer register type from set datatype, removing the conditional check and ensuring consistent validation. Affected Siemens products use SINEC OS with vulnerable kernel versions prior to V3.1.

Defensive priority

medium

Recommended defensive actions

Update affected Siemens devices to SINEC OS V3.1 or later version
Review and apply vendor security advisory SSA-613116 guidance
Implement network segmentation for industrial control systems per CISA recommended practices
Monitor for anomalous nf_tables behavior or unexpected register state changes
Validate nftables rule configurations for proper data type handling

Evidence notes

Vulnerability confirmed in Siemens SINEC OS affecting RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. Root cause is incomplete validation of NFT_DATA_VALUE in nf_tables register store operations. Vendor fix available in V3.1 or later.

Official resources

2025-08-12