PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-56637 Siemens CVE debrief

A race condition vulnerability exists in the Linux kernel netfilter ipset subsystem. The ip_set.ko kernel module can be unloaded by user space while simultaneously requesting a set type backend module, potentially resulting in a kernel crash. This vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE switch families. The issue is local in scope, requiring low privileges and no user interaction, with high availability impact.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 family switches in industrial environments. System administrators responsible for OT/ICS network infrastructure security. Security teams managing firmware lifecycle for industrial networking equipment.

Technical summary

The vulnerability exists in the netfilter ipset subsystem of the Linux kernel. A race condition occurs when user space unloads the ip_set.ko module while a set type backend module request is in progress. This timing window can cause a kernel crash due to use-after-free or null pointer dereference conditions. The attack requires local access with low privileges and no user interaction. Affected Siemens products embed vulnerable Linux kernel versions in their SINEC OS firmware.

Defensive priority

medium

Recommended defensive actions

  • Update affected Siemens products to SINEC OS V3.2 or later. For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult vendor documentation for specific configuration guidance.
  • Apply vendor-provided firmware updates through Siemens Industry Online Support portal.
  • Implement network segmentation for industrial control systems to limit local access vectors.
  • Follow CISA ICS recommended practices for defense-in-depth strategies.
  • Monitor for anomalous kernel module loading/unloading activity on affected systems.

Evidence notes

CVE published 2025-08-12; CISA advisory ICSA-25-226-07 published same date. Siemens ProductCERT advisory SSA-355557 referenced as authoritative source. Advisory modified 2026-02-25 with republication based on updated Siemens guidance. CVSS 3.1 vector confirms local attack vector with low attack complexity.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-56637 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-56637

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-56637 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-56637

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.