PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-53680 Siemens CVE debrief

A medium-severity vulnerability in the Linux kernel's IP Virtual Server (IPVS) subsystem affects Siemens industrial networking products. The flaw involves uninitialized stack memory access in ip_vs_protocol_init(), which can lead to undefined behavior and potential denial of service. The vulnerability requires local access with low privileges and has been addressed through vendor firmware updates.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 family devices. System administrators responsible for industrial control system security, OT security teams, and infrastructure operators in critical manufacturing, energy, and transportation sectors should prioritize assessment and patching.

Technical summary

CVE-2024-53680 is a vulnerability in the Linux kernel's IP Virtual Server (IPVS) subsystem, specifically in the ip_vs_protocol_init() function. The flaw stems from uninitialized stack memory access that can cause undefined behavior. The vulnerability is classified as CWE-20 (Improper Input Validation) and has a CVSS 3.1 score of 5.5 (MEDIUM). The attack requires local access with low privileges and results in high availability impact (denial of service) with no confidentiality or integrity impact. The fix involves zeroing the on-stack buffer to prevent out-of-bounds accesses. Siemens has addressed this vulnerability in affected industrial networking products through firmware updates.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to affected Siemens industrial networking equipment. For RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices, update to firmware version V3.2 or later. For SCALANC
  • Review and implement CISA's ICS recommended practices for defense-in-depth strategies in industrial control system environments.
  • Monitor for additional vendor guidance from Siemens ProductCERT regarding affected SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family configurations.
  • Assess network segmentation to limit local access to affected devices, as the vulnerability requires local attack vector.

Evidence notes

The vulnerability was disclosed in CISA advisory ICSA-25-226-07, which was initially published on 2025-08-12 and subsequently updated on 2026-02-25 to reflect corrections to affected products and republication based on Siemens ProductCERT advisory SSA-355557. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector with low attack complexity and low privileges required, resulting in high availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-53680 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-53680

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-53680 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-53680

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.