PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-56681 Siemens CVE debrief

CVE-2024-56681 is a medium-severity vulnerability (CVSS 5.5) affecting Siemens industrial networking products, specifically the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 families. The vulnerability exists in the Linux kernel's crypto subsystem, specifically in the Broadcom (bcm) crypto driver, where the ahash_hmac_init function fails to properly check error return values from ahash_init. When ahash_init returns an error, ahash_hmac_init incorrectly returns success, potentially leading to undefined behavior or denial of service conditions in cryptographic operations. The vulnerability was published on August 12, 2025, with the advisory last modified on February 25, 2026. Siemens has provided vendor fixes, with updates to version 3.2 or later recommended for affected products.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P industrial switches or SCALANCE XC/XR/XCM/XRM/XCH/XRH industrial Ethernet switches in critical infrastructure, manufacturing, or utility environments. Security teams responsible for OT/ICS asset management and patch deployment should prioritize this update during scheduled maintenance windows.

Technical summary

The vulnerability resides in the Linux kernel's crypto/bcm driver where ahash_hmac_init() does not propagate error returns from ahash_init(). This improper error handling (CWE-20: Improper Input Validation) can result in successful return codes when underlying initialization has failed, potentially causing cryptographic operation failures or system instability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local exploitation with low complexity, low privileges required, no user interaction, and high availability impact. Affected Siemens products incorporate vulnerable Linux kernel versions in their SINEC OS firmware.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided updates to version 3.2 or later for affected Siemens RUGGEDCOM RST2428P and SCALANCE product families
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT SSA-355557 for specific configuration guidance
  • Implement defense-in-depth strategies for industrial control systems per CISA recommended practices
  • Monitor for anomalous cryptographic operation failures on affected devices
  • Restrict local access to affected systems to authorized personnel only

Evidence notes

Vulnerability description derived from CISA CSAF advisory ICSA-25-226-07 and Siemens ProductCERT SSA-355557. Affected products confirmed through CSAF product tree with high confidence. CVSS vector indicates local attack vector with low attack complexity, requiring low privileges but no user interaction, with high availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-56681 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-56681

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-56681 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-56681

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.