Machine-generated analysis · WAYSCloud LLM
The advisory states that SINEC OS versions prior to 4.0 contain multiple vulnerabilities, including buffer overflows and improper access control, with a maximum CVSS score of 9.8.
Context
The affected product is Siemens SINEC OS, specifically on the RUGGEDCOM RST2428P device (6GK6242-6PA00). The advisory identifies 27 distinct vulnerability types, including out-of-bounds read/write, path traversal, and authentication bypass, which could allow remote unauthenticated attackers to execute arbitrary code or cause denial of service. The product is used in critical manufacturing, energy, transportation, healthcare, financial services, and government sectors. Deployment is reported as worldwide, with Siemens headquartered in Germany.
Operator considerations
Check: Inventory RUGGEDCOM RST2428P devices running SINEC OS versions prior to 4.0
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
Read the full advisory on CISA →