PatchSiren cyber security CVE debrief

CVE-2024-42087 Siemens CVE debrief

CISA republished a Siemens ProductCERT advisory on 2026-02-25 regarding CVE-2024-42087, a Linux kernel display driver issue affecting the ilitek-ili9881c panel driver. The underlying vulnerability involves a warning condition with GPIO controllers. Siemens has assessed the impact as misinformed for affected SINEC OS-based products, indicating the vulnerability does not pose a practical security risk in their deployment context. No CVSS score has been assigned. The advisory was initially published by CISA on 2025-08-12 and subsequently updated to correct product lists and clarify affected configurations. Organizations should consult Siemens ProductCERT guidance for definitive product impact assessments.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family, or RUGGEDCOM RST2428P industrial network devices should review this advisory to confirm their specific product configurations and firmware versions are not affected, and to apply vendor guidance as appropriate.

Technical summary

CVE-2024-42087 is a Linux kernel vulnerability in the drm/panel driver for the Ilitek ILI9881C display panel controller. The issue manifests as a warning condition related to GPIO controller handling. The vulnerability was included in a Siemens ProductCERT advisory covering third-party components in SINEC OS, which is used in Siemens industrial network devices including SCALANCE and RUGGEDCOM product families. Siemens has assessed the security impact as misinformed, indicating that the vulnerability does not present a practical security concern in their operational technology deployment context. The advisory has undergone multiple revisions, with the most recent CISA republication on 2026-02-25 incorporating corrections to affected product lists and configuration clarifications. No CVSS score has been assigned to this CVE.

Defensive priority

low

Recommended defensive actions

Review Siemens ProductCERT SSA-355557 advisory for product-specific impact determination
Verify SINEC OS and affected Siemens network device firmware versions against vendor guidance
Apply vendor-provided updates when available per organizational patch management policy
Monitor CISA ICS advisories for subsequent updates to this vulnerability

Evidence notes

CVE published 2025-08-12; CISA republication 2026-02-25 based on Siemens SSA-355557. Siemens assessed impact as misinformed. No CVSS assigned.

Official resources

2025-08-12