# Siemens RUGGEDCOM RST2428P DoS and info disclosure

Published: 2025-09-11 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/945e0d7d-5886-5726-86e7-7d816220b184/siemens-ruggedcom-rst2428p-dos-and-info-disclosure

> Two low-severity adjacent-network vulnerabilities in Siemens RUGGEDCOM RST2428P allow DoS and unauthenticated data access; no active exploitation reported.

CISA published a security advisory covering two vulnerabilities in Siemens RUGGEDCOM RST2428P industrial networking device affecting all versions. CVE-2025-40802 is an uncontrolled resource consumption flaw (CWE-400) that permits a temporary denial of service when subjected to high-volume query requests over the adjacent network; the device recovers once the attack ceases. CVE-2025-40803 exposes non-critical device information (CWE-200) to unauthenticated attackers on the adjacent network, potentially leading to breach of confidentiality. Both vulnerabilities require adjacent network access, high attack complexity, and carry CVSS v3.1 scores of 3.1. CISA confirms no known public exploitation and notes the vulnerabilities are not remotely exploitable. Siemens recommends firewall rules blocking UDP 34964 and ports in the range 49152-65535 if discovery protocols are not required, and general network segmentation for industrial control systems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40802, CVE-2025-40803

## Detection guidance (public sample)

### Network Traffic to PROFINET Context Manager UDP Port 34964 (Possible ICS Device Query Flood)

ATT&CK: T1498.001

Detects firewall-logged traffic to UDP/TCP port 34964, which Siemens advises blocking when discovery protocols are not needed on RUGGEDCOM RST2428P. Alert on high volume from a single source in a short window (for example more than 500 events per minute), which the SIEM must apply as a threshold because Sigma cannot express it here. A single hit is only a discovery or query event. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Network Traffic to PROFINET Context Manager UDP Port 34964 (Possible ICS Device
  Query Flood)
description: Detects firewall-logged traffic to port 34964, which Siemens advises
  blocking when discovery protocols are not required on RUGGEDCOM RST2428P devices
  (CVE-2025-40802 resource exhaustion and CVE-2025-40803 information disclosure).
  Apply a per-source volume threshold in the SIEM, for example more than 500 events
  per minute, to separate a query flood from normal engineering discovery.
status: experimental
tags:
- attack.impact
- attack.t1498.001
logsource:
  category: firewall
detection:
  selection:
    dst_port: 34964
  filter_known_engineering:
    src_ip|cidr:
    - 127.0.0.0/8
  condition: selection and not filter_known_engineering
falsepositives:
- Legitimate PROFINET engineering stations or network management tools performing
  device discovery and configuration
- Asset inventory scanners that probe industrial protocol ports
level: low
id: 749a53fe-eeca-5be2-967c-f46c7c301670
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/945e0d7d-5886-5726-86e7-7d816220b184/siemens-ruggedcom-rst2428p-dos-and-info-disclosure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup