PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-45025 Siemens CVE debrief

CVE-2024-45025 is a medium-severity vulnerability (CVSS 5.5) affecting Siemens industrial networking products running SINEC OS. The issue involves bitmap corruption in the close_range() system call when using the CLOSE_RANGE_UNSHARE flag with copy_fd_bitmaps, which can lead to denial of service conditions. The vulnerability was published on August 12, 2025, and subsequently modified on February 25, 2026, when CISA republished the advisory based on updated Siemens ProductCERT guidance. Affected products include the RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family. Siemens has provided vendor fixes, with updates to version 3.2 or later recommended for most affected products. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact with no confidentiality or integrity impact.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly those deploying RUGGEDCOM RST2428P devices or SCALANCE XC/XR/XCM/XRM/XCH/XRH switch families in critical infrastructure environments. OT security teams, network administrators, and asset owners in manufacturing, energy, transportation, and other industrial sectors relying on SINEC OS-based devices should prioritize this update to prevent potential denial of service conditions that could disrupt industrial operations.

Technical summary

CVE-2024-45025 is a vulnerability in the Linux kernel's close_range() system call implementation, specifically affecting the copy_fd_bitmaps function when the CLOSE_RANGE_UNSHARE flag is used. This results in bitmap corruption that can cause denial of service conditions. The vulnerability manifests in Siemens industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P platform and multiple SCALANCE switch families. The issue is locally exploitable with low complexity and requires low privileges, but has no confidentiality or integrity impact—only high availability impact. Siemens has addressed this through SINEC OS updates to version 3.2 or later. The vulnerability was initially disclosed in August 2025 and the advisory was significantly updated in February 2026 to clarify affected product configurations and remove rejected CVE entries from the advisory scope.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided updates to version 3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and available updates
  • Implement network segmentation for industrial control systems to limit exposure of affected devices
  • Monitor for anomalous behavior or unexpected process terminations that could indicate exploitation attempts
  • Follow CISA ICS recommended practices for defense-in-depth strategies
  • Review and apply Siemens security advisories as they are published for SINEC OS-based products

Evidence notes

The vulnerability description and affected products are sourced from CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The CVSS score and vector are derived from the official CISA CSAF data. Timeline information reflects the CVE publication date of August 12, 2025, and the most recent modification on February 25, 2026, per the source advisory revision history.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-45025 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-45025

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-45025 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-45025

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.