PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-46740 Siemens CVE debrief

CVE-2024-46740 is a high-severity vulnerability in the Linux kernel binder driver, specifically a use-after-free (UAF) condition caused by offsets overwrite. The vulnerability was published on August 12, 2025, and most recently modified on February 25, 2026. Siemens has identified this vulnerability as affecting multiple industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The CVSS 3.1 vector indicates a local attack vector with low attack complexity, requiring low privileges but no user interaction, with high impacts to confidentiality, integrity, and availability. The vulnerability stems from the Android/Linux binder IPC mechanism, where improper handling of buffer offsets can lead to memory corruption and potential privilege escalation. Siemens has released updates to address this issue, with remediation requiring upgrade to SINEC OS V3.2 or later for affected RUGGEDCOM and SCALANCE products.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family industrial networking equipment should prioritize assessment and remediation. This includes critical infrastructure operators, manufacturing facilities, utilities, and transportation systems relying on these devices for network segmentation and industrial communications. Security teams responsible for OT/ICS environments, system integrators deploying Siemens networking products, and compliance officers tracking CVE remediation for industrial assets should review this advisory.

Technical summary

CVE-2024-46740 describes a use-after-free vulnerability in the Linux kernel's binder driver, specifically triggered by improper handling of buffer offsets during IPC transactions. The binder driver, used for inter-process communication in Android and embedded Linux systems, fails to properly validate offset data, allowing an attacker to corrupt memory and potentially escalate privileges. In the context of Siemens industrial products, this vulnerability affects devices running SINEC OS that incorporate the vulnerable kernel component. The attack requires local access with low privileges, making it a significant concern for multi-user or containerized environments where process isolation is critical. Successful exploitation could result in complete compromise of device confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor-provided updates to SINEC OS V3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and update paths
  • Implement network segmentation to limit local access to affected industrial control systems
  • Monitor for anomalous local process behavior that may indicate exploitation attempts
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

Vulnerability description and affected products confirmed through CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. CVSS vector and remediation details sourced from official Siemens and CISA documentation. Timeline reflects CVE publication date of 2025-08-12 and subsequent modifications through 2026-02-25.

Official resources

2025-08-12