PatchSiren cyber security CVE debrief

CVE-2024-46719 Siemens CVE debrief

A null pointer dereference vulnerability exists in the Linux kernel's USB Type-C UCSI (USB Type-C Connector System Software Interface) driver. The flaw occurs in the `ucsi_register_altmode` function, which checks for error pointers using `IS_ERR` but incorrectly treats NULL as a valid return value. When `CONFIG_TYPEC_DP_ALTMODE` is not enabled, `ucsi_register_displayport` returns NULL, leading to a NULL pointer dereference in trace operations. This vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE switch families. The issue is rated MEDIUM severity (CVSS 5.5) with local attack vector, low attack complexity, and low privileges required, resulting in high availability impact. The vulnerability was published on August 12, 2025, and the advisory was last modified on February 25, 2026. Siemens has released updates to address this issue.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 families. System administrators responsible for Linux kernel configurations in industrial environments. Security teams managing OT/ICS infrastructure with USB Type-C connectivity requirements.

Technical summary

The vulnerability exists in the Linux kernel's USB Type-C UCSI driver, specifically in `ucsi_register_altmode`. The function uses `IS_ERR` to check for error conditions but fails to validate NULL pointers. When `CONFIG_TYPEC_DP_ALTMODE` is disabled, `ucsi_register_displayport` returns NULL instead of registering the DisplayPort alternate mode, causing a NULL pointer dereference during trace operations. The fix involves calling `typec_port_register_altmode` to register DisplayPort as a non-controllable mode when the configuration option is not enabled, rather than returning NULL. This is a local vulnerability requiring low privileges with no confidentiality or integrity impact, but high availability impact through potential system crashes.

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided firmware updates to V3.2 or later for affected Siemens RUGGEDCOM RST2428P and SCALANCE switch families
Verify CONFIG_TYPEC_DP_ALTMODE kernel configuration on affected systems where custom kernel builds are used
Monitor for kernel panics or crashes related to USB Type-C alternate mode registration in system logs
Implement network segmentation for industrial control systems to limit exposure of affected devices
Review CISA ICS recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

Vulnerability description and affected products confirmed through CISA ICS advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. CVSS vector confirms local attack vector with availability impact. Remediation guidance specifies firmware updates to V3.2 or later for affected products.

Sources and references

Verified primary and authoritative sources

CVE-2024-46719 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-46719

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-46719 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-46719

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.