PatchSiren cyber security CVE debrief

CVE-2024-49973 Linux CVE debrief

CVE-2024-49973 describes a vulnerability in the r8169 network driver affecting the RTL8125 Ethernet controller. The issue stems from added fields to the tally counter structure, which could cause the chip to perform Direct Memory Access (DMA) on these new fields and potentially write to unallocated memory. This represents a memory safety issue that could lead to system instability or memory corruption. The vulnerability was published on August 12, 2025, and subsequently modified on February 25, 2026. Siemens has identified this CVE as affecting certain industrial networking products including the RUGGEDCOM RST2428P and SCALANCE product families, though the CISA advisory marks the impact assessment as 'Misinformed' for the tracked product IDs. Organizations should consult vendor guidance for patch availability and apply updates according to their risk management procedures.

Vendor: Linux
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

System administrators managing Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. Organizations running SINEC OS with affected third-party kernel components should prioritize vendor patch review. Industrial control system operators following CISA guidance for network infrastructure security.

Technical summary

The r8169 driver for Realtek RTL8125 Ethernet controllers contains a vulnerability where added fields to the tally counter structure may cause the hardware to perform DMA operations on uninitialized or unallocated memory regions. This hardware-level DMA behavior can result in memory corruption, system crashes, or undefined behavior. The vulnerability is classified under CWE-787 (Out-of-bounds Write).

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-355557 for detailed product impact and patch guidance
Verify r8169 driver versions on affected Siemens industrial networking equipment
Apply vendor-provided firmware updates for RUGGEDCOM RST2428P and SCALANCE families when available
Monitor CISA ICS advisories for updates to ICSA-25-226-07
Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The threat category in the source data is marked as 'Misinformed' for the affected product IDs (CSAFPID-0006, CSAFPID-0002, CSAFPID-0003), indicating potential clarification or correction in impact assessment. The advisory was republished by CISA on February 25, 2026, based on updated Siemens guidance.

Sources and references

Verified primary and authoritative sources

CVE-2024-49973 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-49973

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-49973 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-49973

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.