Rewterz Threat Advisory – ICS: Multiple Siemens Products Vulnerabilities

Severity

High

Analysis Summary

CVE-2024-26592 CVSS:9

Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free within the handling of TCP connection and disconnection. An attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2024-26594 CVSS:9.3

Linux Kernel could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read within the handling of SMB2 Mech Tokens. An attacker could exploit this vulnerability to obtain sensitive information and execute arbitrary code on the system.

Impact

• Gain Access
• Information Disclosure

Indicators Of Compromise

CVE

• CVE-2024-26592
• CVE-2024-26594

Affected Vendors

Linux

Affected Products

• Linux Kernel

Remediation

Refer to Linux Kernel GIT Repository for patch, upgrade or suggested workaround information.

CVE-2024-26592

CVE-2024-26594