PatchSiren cyber security CVE debrief

CVE-2024-40934 Siemens CVE debrief

This CVE addresses a memory leak in the Linux kernel's HID Logitech DJ driver, specifically in the `logi_dj_recv_switch_to_dj_mode()` function. The vulnerability occurs on the error path of `logi_dj_recv_send_report()` where allocated memory is not properly freed, leading to resource exhaustion over time. Siemens has identified this as affecting certain industrial networking products that incorporate the vulnerable Linux kernel component, including the RUGGEDCOM RST2428P and SCALANCE X family switches running SINEC OS. The CISA advisory ICSA-25-226-07, published August 12, 2025, tracks this vulnerability as part of a broader third-party component security assessment. Notably, the advisory underwent significant revision in February 2026, including removal of multiple rejected CVEs and clarification of affected product configurations. The vulnerability is classified as 'Misinformed' impact in the CSAF data, suggesting limited practical exploitability in the identified Siemens deployment context. No CVSS score has been assigned in the available sources.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 4.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

System administrators managing Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family switches; industrial control system security teams; organizations with OT/ICS networks utilizing SINEC OS; vulnerability management programs tracking third-party component security in embedded systems

Technical summary

The vulnerability exists in the Linux kernel's HID Logitech DJ (Device Junction) receiver driver. When `logi_dj_recv_send_report()` fails, the error path in `logi_dj_recv_switch_to_dj_mode()` does not properly free previously allocated memory, resulting in a memory leak. This is a classic resource management defect (CWE-404: Improper Resource Shutdown or Release). In the Siemens deployment context, this affects industrial Ethernet switches running SINEC OS that incorporate the vulnerable kernel component. The 'Misinformed' impact classification in the CSAF data suggests that while the vulnerability exists in the underlying component, its practical security impact in the identified Siemens products may be limited or require specific conditions to manifest.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-355557 for detailed affected product configurations and patch availability
Verify kernel version on affected SINEC OS deployments and apply vendor-provided updates
Monitor system memory utilization on affected industrial switches for signs of resource exhaustion
Implement network segmentation for industrial control systems per CISA recommended practices
Subscribe to Siemens ProductCERT and CISA ICS advisories for future updates on this vulnerability

Evidence notes

Memory leak vulnerability in Linux HID Logitech DJ driver; affects Siemens industrial networking products via SINEC OS; classified as 'Misinformed' impact in CSAF threat data; advisory revised multiple times with product scope clarifications

Sources and references

Verified primary and authoritative sources

CVE-2024-40934 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-40934

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-40934 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-40934

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.