Siemens Linux-based Products (Update J)

An attacker with network access to a DNS resolver on one of these devices could manipulate DNS responses, causing control systems to connect to incorrect network destinations. This could disrupt communication between engineering workstations, SCADA systems, and field devices, or redirect traffic to malicious servers.

This affects multiple Siemens industrial networking products used in transportation and utility environments: communication modules (SIMATIC CP series), mobile routers (SCALANCE M-800, SCALANCE W1750D), rugged switches (RUGGEDCOM RM1224), industrial edge devices (SIMATIC MV series), cloud connectivity gateways (SIMATIC Cloud Connect 7), and remote access servers (SINEMA Remote Connect Server). Organizations using these devices for plant-wide network communication, remote engineering access, or inter-site connectivity should prioritize patching.

An attacker sends specially crafted ICMP packets to trigger a flaw in the Linux kernel's DNS resolver handling on the affected device. By exploiting this weakness, the attacker can inject false DNS responses that redirect subsequent queries to attacker-controlled addresses. The attack requires network reachability to the device but does not require authentication or user interaction.