PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-47705 Siemens CVE debrief

This CVE addresses a vulnerability in the Linux kernel's block layer where an invalid pointer dereference could occur in the blk_add_partition() function. The issue stemmed from a code refactoring that modified error handling to separately process -ENXIO errors, inadvertently creating a code path where md_autodetect_dev() could be called without verifying that the partition pointer was valid. The vulnerability has a CVSS 3.1 score of 5.5 (MEDIUM severity), with a local attack vector requiring low privileges and resulting in high availability impact. Siemens has identified affected products in their industrial networking equipment lines, including RUGGEDCOM RST2428P and SCALANCE switch families. The vulnerability was published on August 12, 2025, with the advisory last modified on February 25, 2026.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC/XR/XCM/XRM/XCH/XRH switch families. System administrators responsible for Linux-based industrial control systems and OT security teams monitoring kernel-level vulnerabilities in embedded industrial devices.

Technical summary

The vulnerability exists in the Linux kernel's block device partition handling code. A refactoring of blk_add_partition() introduced a logic error where the -ENXIO error case was handled separately from general error conditions, but this change failed to ensure that md_autodetect_dev() would only be called with a valid partition pointer. The fix separates error handling logic to explicitly distinguish between general errors and -ENXIO while maintaining proper pointer validation. This is a local vulnerability requiring authenticated access, with exploitation potentially causing denial of service through invalid memory access.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance
  • Implement network segmentation for industrial control systems to limit local access to affected devices
  • Monitor for anomalous system behavior or unexpected reboots that could indicate exploitation attempts
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies
  • resourceLinkAnnotations:ref-4,ref-5,ref-6,ref-8

Evidence notes

The vulnerability description is derived from the Linux kernel commit message explaining the fix for blk_add_partition(). The affected products and remediation guidance are sourced from CISA CSAF data identifying Siemens RUGGEDCOM and SCALANCE product lines. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector with high availability impact but no confidentiality or integrity impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-47705 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-47705

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-47705 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-47705

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.