PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-47698 Siemens CVE debrief

CVE-2024-47698 is an out-of-bounds access vulnerability in the Linux kernel's RTL2832 DVB frontend driver. The flaw occurs when the rtl2832_pid_filter parameter exceeds 31 without proper bounds verification, potentially leading to memory corruption. This vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The issue was initially published on August 12, 2025, with subsequent advisory updates through February 25, 2026, including corrections to affected product listings and removal of rejected CVEs. Siemens has assessed the impact as 'Misinformed' for the affected products, indicating the vulnerability's applicability may be limited or mischaracterized in certain contexts. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Organizations should consult Siemens ProductCERT advisory SSA-355557 for specific patch guidance and follow CISA's ICS recommended practices for defense-in-depth strategies.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P or SCALANCE XC/XR-series industrial Ethernet switches with SINEC OS. OT security teams managing Linux-based embedded systems in critical infrastructure. Asset owners requiring visibility into third-party kernel components in vendor firmware. Compliance teams tracking CVE remediation for NERC CIP, IEC 62443, or similar industrial cybersecurity frameworks.

Technical summary

The vulnerability exists in drivers/media/dvb-frontends/rtl2832.c where the rtl2832_pid_filter function lacks bounds checking on values exceeding 31. This can result in out-of-bounds memory access when processing PID filter configurations. The RTL2832 is a DVB-T demodulator commonly used in USB TV tuners; its presence in industrial networking firmware suggests potential supply chain or feature inclusion rather than primary operational functionality. The 'Misinformed' impact rating from Siemens indicates the vulnerability may not be exploitable in practice due to configuration constraints, disabled functionality, or architectural protections in the affected product lines.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for detailed product-specific impact assessment and patch availability
  • Verify SINEC OS version and kernel configuration on affected RUGGEDCOM and SCALANCE devices
  • Assess whether DVB frontend functionality (rtl2832 driver) is enabled or exposed in operational deployments
  • Apply vendor-provided firmware updates when available, prioritizing internet-facing or critical infrastructure systems
  • Implement network segmentation to limit exposure of industrial control system devices per CISA ICS recommended practices
  • Monitor for anomalous behavior in media/DVB subsystem operations if driver cannot be disabled
  • Document and maintain inventory of third-party Linux kernel components in embedded industrial products

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-25-226-07. Impact assessment of 'Misinformed' per Siemens ProductCERT evaluation. Affected products identified through CSAF product tree: RUGGEDCOM RST2428P (6GK6242-6PA00) and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family. Advisory revision history shows four updates, with the latest on 2026-02-25 clarifying affected configurations and removing rejected CVEs.

Official resources

2025-08-12