Siemens RUGGEDCOM RST2428P SINEC OS Patched
Siemens fixed dozens of third-party library and Linux kernel vulnerabilities in SINEC OS affecting RUGGEDCOM RST2428P switches, urging an update to V4.0.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 37 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2025-40271 (poc); no exploitation in the wild is recorded.
Siemens has disclosed a large batch of vulnerabilities affecting SINEC OS versions prior to V4.0, impacting the RUGGEDCOM RST2428P industrial switch. The flaws originate from bundled open-source components including GNU elfutils, GLib, ncurses, libxml2, curl, OpenSSL, Lodash, and the Linux kernel itself, covering issues such as memory corruption, buffer overflows, integer overflows, path traversal, prototype pollution, out-of-bounds reads/writes, and a timing side-channel in SM2 signature computations on ARM64 platforms.
Most of these vulnerabilities require local access or high attack complexity, and several (e.g., CVE-2025-8732, CVE-2025-9232) are assessed as low-to-moderate severity by their respective upstream maintainers, with limited real-world exploitability. However, a subset—including CVE-2025-1352 (critical-rated memory corruption in elfutils) and CVE-2025-9086 (curl cookie handling flaw)—have public exploit disclosures available, though practical exploitation remains difficult. No active exploitation against Siemens products has been reported.
Siemens recommends updating affected RUGGEDCOM RST2428P devices to SINEC OS V4.0 or later, which resolves the full set of inherited third-party component vulnerabilities. Given the product's deployment across critical manufacturing, transportation, energy, healthcare, financial services, and government sectors worldwide, organizations operating these switches should prioritize patching as part of routine industrial control system maintenance, though the overall risk profile is consistent with a standard third-party component roll-up advisory rather than an actively exploited threat.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-05
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs