PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-46750 Siemens CVE debrief

A missing bridge lock in the Linux kernel's PCI subsystem could allow local attackers to cause denial-of-service conditions. The vulnerability exists in pci_bus_lock() where proper locking mechanisms were not implemented, potentially leading to race conditions. Siemens has identified affected industrial networking products running SINEC OS that incorporate the vulnerable Linux kernel component.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly in critical infrastructure sectors. System administrators managing RUGGEDCOM and SCALANCE devices should prioritize firmware updates. Security teams monitoring OT/ICS environments should track this vulnerability for potential local attack vectors from compromised endpoints.

Technical summary

The vulnerability stems from a missing bridge lock implementation in pci_bus_lock() within the Linux kernel's PCI subsystem. This locking deficiency creates a race condition window that local attackers with low privileges can exploit to trigger denial-of-service conditions. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact with no confidentiality or integrity impact. Affected Siemens products include RUGGEDCOM RST2428P and multiple SCALANCE industrial Ethernet switch families running SINEC OS.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM and SCALANCE products
  • Review Siemens ProductCERT advisory SSA-355557 for specific configuration guidance on SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
  • Implement defense-in-depth strategies for industrial control systems per CISA recommended practices
  • Monitor CISA ICS advisories for additional updates to affected product listings

Evidence notes

The vulnerability was resolved by adding the missing bridge lock to pci_bus_lock() in the Linux kernel. CISA published advisory ICSA-25-226-07 on 2025-08-12, with subsequent updates through 2026-02-25 to correct affected product listings and clarify configuration details. Siemens ProductCERT issued SSA-355557 as the authoritative vendor advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-46750 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-46750

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-46750 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-46750

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.