PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-44995 Siemens CVE debrief

A deadlock vulnerability exists in the HNS3 (Hisilicon Network Subsystem 3) Ethernet driver within the Linux kernel. The issue occurs when configuring Traffic Control (TC) during a device reset operation, leading to a race condition that can cause system deadlock. This affects Siemens industrial networking products running SINEC OS that incorporate the vulnerable kernel component. The vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 5.5, reflecting local attack vector and high availability impact. The CISA advisory ICSA-25-226-07, published 2025-08-12 and most recently updated 2026-02-25, coordinates disclosure for affected Siemens products.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM and SCALANCE industrial networking infrastructure, particularly those in critical infrastructure sectors (energy, manufacturing, transportation) where network availability is essential. System administrators responsible for SINEC OS-based devices and security teams monitoring industrial control system vulnerabilities should prioritize assessment and patching.

Technical summary

The vulnerability resides in the HNS3 network driver (drivers/net/ethernet/hisilicon/hns3) in the Linux kernel. A race condition between TC (Traffic Control) configuration operations and device reset handling can result in a deadlock, causing the network interface or system to become unresponsive. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates this is locally exploitable with low attack complexity, requiring low privileges but no user interaction, with confidentiality and integrity impacts none but availability impact high. Affected Siemens products are industrial Ethernet switches and routers used in operational technology environments.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and update paths
  • Implement network segmentation for industrial control systems to limit local access to affected devices
  • Monitor for system hangs or unresponsiveness in affected network infrastructure devices
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

CVE description confirms deadlock in net: hns3 during TC configuration during reset. CISA CSAF advisory ICSA-25-226-07 identifies affected Siemens products: RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family. CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack, low complexity, low privileges required, no user interaction, and high availability impact.

Official resources

coordinated