PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-46771 Siemens CVE debrief

A vulnerability in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) subsystem allows a use-after-free condition when a network device is unregistered. The BCM protocol creates proc filesystem entries for CAN sockets, but these entries were not properly removed when the underlying CAN device was unregistered. This could lead to local denial of service through memory corruption or system instability. The vulnerability affects Siemens industrial networking products running SINEC OS, which incorporates the vulnerable Linux kernel component. The issue is rated MEDIUM severity with a CVSS 3.1 score of 5.5, reflecting local attack vector and high availability impact.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices in industrial control environments. System administrators responsible for CAN bus implementations in critical infrastructure, manufacturing, and process control industries should prioritize patching. Security teams monitoring OT/ICS environments for kernel-level vulnerabilities affecting availability.

Technical summary

The vulnerability exists in the Linux kernel's CAN (Controller Area Network) Broadcast Manager (BCM) implementation. When a CAN network device is unregistered, the associated proc filesystem entry created by BCM sockets is not removed, leading to a stale pointer condition. This use-after-free vulnerability can be triggered by local users with appropriate privileges, resulting in system crashes or memory corruption. The fix ensures proper cleanup of proc entries during device unregistration. Siemens industrial networking products incorporating the vulnerable kernel component are affected, with vendor fixes available through firmware updates.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and update paths
  • Implement network segmentation to limit access to industrial control system networks
  • Monitor for anomalous local access attempts to CAN-enabled devices
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

CISA published advisory ICSA-25-226-07 on 2025-08-12, subsequently updated on 2026-02-25 to reflect Siemens ProductCERT SSA-355557 advisory. The vulnerability description indicates a kernel-level issue in the CAN BCM subsystem where proc entries are not cleaned up on device unregistration. Siemens has issued vendor fixes for affected RUGGEDCOM and SCALANCE product families.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-46771 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-46771

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-46771 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-46771

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.