PatchSiren cyber security CVE debrief

CVE-2024-46761 Siemens CVE debrief

A vulnerability in the PCI hotplug driver (pnv_php) for PowerNV platforms can cause a driver crash. The issue affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. A local attacker with low privileges can trigger a denial-of-service condition without user interaction. The vulnerability was disclosed on August 12, 2025, with the advisory last updated on February 25, 2026, to reflect corrections to affected product lists and additional configuration clarifications. Siemens has released updates to address this issue.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P or SCALANCE X-family industrial Ethernet switches in critical infrastructure environments, particularly those in power generation, transportation, and manufacturing sectors where high availability is required. Security teams responsible for OT/ICS asset management and patch deployment should prioritize assessment.

Technical summary

The pnv_php driver in the Linux kernel's PCI hotplug subsystem for IBM PowerNV (Power Non-Virtualized) platforms contains a vulnerability that can result in a driver crash. This affects Siemens industrial networking equipment that incorporates the vulnerable component. The CVSS 3.1 score of 5.5 reflects a local attack vector where an attacker with low privileges can cause high availability impact without user interaction. The vulnerability does not affect confidentiality or integrity. Siemens has addressed this through updates to SINEC OS V3.2 and later for most affected products, with specific guidance for the SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family depending on configuration.

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided updates to V3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and update availability
Implement defense-in-depth strategies for industrial control systems per CISA recommended practices
Restrict local access to affected systems to authorized personnel only
Monitor for anomalous system behavior or unexpected driver crashes that may indicate exploitation attempts

Evidence notes

The vulnerability description indicates a crash in the pnv_php (PowerNV PCI hotplug) driver. CVSS 3.1 vector confirms local attack vector with low attack complexity, low privileges required, and high availability impact. CISA ICS advisory ICSA-25-226-07 and Siemens ProductCERT SSA-355557 provide authoritative vendor confirmation. The February 2026 updates corrected product scope and removed rejected CVEs from the advisory.

Official resources

2025-08-12