CVE-2025-40802 Overview
Siemens disclosed a resource exhaustion vulnerability affecting the RUGGEDCOM RST2428P (6GK6242-6PA00) industrial switch across all firmware versions. The flaw allows an adjacent-network attacker to overwhelm the device with a high volume of query requests, triggering a temporary denial-of-service condition. The affected device recovers automatically once the abusive traffic stops.
The issue is tracked under CWE-400: Uncontrolled Resource Consumption and is documented in Siemens Security Advisory SSA-494539. The RUGGEDCOM RST2428P is deployed in substations, transportation, and other operational technology (OT) environments where availability directly affects industrial processes.
Critical Impact
An unauthenticated attacker on an adjacent network can cause temporary denial of service on RUGGEDCOM RST2428P switches, disrupting availability of connected industrial systems until traffic subsides.
Affected Products
- Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) — all firmware versions
- Siemens RUGGEDCOM RST2428P firmware — all versions
- Deployments using the affected switch model in substation and industrial networks
Discovery Timeline
- 2025-09-09 - CVE-2025-40802 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-40802
Vulnerability Analysis
The RUGGEDCOM RST2428P does not enforce sufficient rate limiting or resource controls on incoming query requests. When a client sends a sustained high volume of queries, the device consumes finite CPU, memory, or session resources faster than it can release them. Legitimate management or control traffic is starved, and the switch becomes unresponsive.
Because the attack targets availability of a Layer 2/3 industrial switch, downstream devices relying on the switch for network connectivity may lose communication with SCADA systems, protection relays, or engineering workstations. The advisory notes that the device recovers on its own once the flood ends, so persistent compromise is not required.
The attack requires network adjacency, meaning the attacker must reach the switch's management or data-plane interface, typically from within the same Layer 2 segment or a routable OT network. No authentication or user interaction is needed to trigger the condition.
Root Cause
The root cause is uncontrolled resource consumption [CWE-400] in the query-handling logic of the device firmware. The affected code path lacks throttling, connection quotas, or backpressure to bound the work performed per unit of time. Refer to Siemens Security Advisory SSA-494539 for vendor technical details.
Attack Vector
Exploitation requires network access to the switch's query interface from an adjacent network position. An attacker generates a sustained burst of query requests using standard networking tools. The device's request handler saturates, causing management responsiveness and packet processing to degrade. Service is restored automatically when the attacker stops sending traffic. No proof-of-concept exploit is publicly available at the time of publication.
Detection Methods for CVE-2025-40802
Indicators of Compromise
- Sudden loss of responsiveness or elevated latency from RUGGEDCOM RST2428P management interfaces
- Spikes in inbound query traffic toward the switch from a single or small set of source addresses on the local segment
- SNMP traps or syslog entries indicating high CPU utilization or dropped management sessions on the device
Detection Strategies
- Baseline normal query volumes to the switch and alert on statistical deviations that exceed operational norms
- Correlate loss of connectivity events from downstream OT assets with traffic surges destined for the switch's IP address
- Enable and forward device syslog to a centralized platform for continuous monitoring of resource-related warnings
Monitoring Recommendations
- Ingest RUGGEDCOM switch syslog and SNMP telemetry into a SIEM or OT monitoring tool for correlation
- Deploy passive OT network monitoring on segments containing the switch to identify anomalous query bursts
- Track CPU, memory, and session-table utilization metrics on the device and alert on sustained saturation
How to Mitigate CVE-2025-40802
Immediate Actions Required
- Review Siemens Security Advisory SSA-494539 for the most current vendor guidance and any released firmware updates
- Restrict management-plane access to the RUGGEDCOM RST2428P using dedicated management VLANs and firewall access control lists
- Ensure the device is deployed inside a defense-in-depth architecture aligned with Siemens' Operational Guidelines for Industrial Security
Patch Information
At the time of publication, consult Siemens ProductCERT advisory SSA-494539 for the authoritative list of fixed firmware versions and remediation status for RUGGEDCOM RST2428P (6GK6242-6PA00).
Workarounds
- Apply network segmentation to limit which hosts can reach the switch's query and management interfaces
- Configure upstream firewalls or Layer 3 access control lists to rate-limit or block untrusted query traffic to the device
- Monitor for unusual query volumes and be prepared to isolate offending sources at upstream network devices until firmware remediation is available
# Example upstream ACL concept to limit query traffic sources to the switch
# Replace <SWITCH_IP>, <MGMT_SUBNET>, and query port with your environment values
access-list 150 permit ip <MGMT_SUBNET> host <SWITCH_IP>
access-list 150 deny ip any host <SWITCH_IP> log
interface <uplink>
ip access-group 150 in
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
