PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41017 Siemens CVE debrief

CVE-2024-41017 is a vulnerability in the Journaled File System (jfs) involving out-of-bounds memory access beyond the end of ealist, which can lead to undefined behavior or crashes. The vulnerability was published on August 12, 2025, and most recently modified on February 25, 2026. Siemens ProductCERT issued advisory SSA-355557 addressing this issue, which CISA subsequently republished as ICSA-25-226-07. The advisory was updated multiple times, with the February 25, 2026 revision representing the latest CISA republication based on the Siemens advisory. Notably, the CISA advisory revision history indicates that on February 24, 2026, multiple CVEs were removed from the advisory as rejected, though CVE-2024-41017 remains listed. The vulnerability affects Siemens industrial networking products including RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS. No CVSS score or severity rating is currently available in the source data. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure, particularly those deploying RUGGEDCOM RST2428P switches or SCALANCE X-family managed switches in critical infrastructure environments. OT security teams, ICS asset owners, and network administrators responsible for SINEC OS-based industrial networks should prioritize monitoring vendor advisories and applying patches when available. Given the industrial target environment, organizations in manufacturing, energy, transportation, and other critical infrastructure sectors using affected Siemens products should assess exposure and implement compensating controls pending patch availability.

Technical summary

The vulnerability exists in the Journaled File System (jfs) implementation where improper bounds checking on ealist access can result in reading memory beyond allocated boundaries. This out-of-bounds access condition can trigger undefined behavior or system crashes. The vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switch series (XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 families). The underlying issue appears to be an input validation weakness (CWE-20) in filesystem handling code. No CVSS scoring information is available in current sources to assess exploitability or impact severity. The advisory threat categorization of 'Misinformed' suggests potential for information disclosure or integrity impacts rather than direct code execution, though this should be verified against vendor technical documentation.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for detailed product-specific guidance and patch availability
  • Verify SINEC OS version and affected product configurations against Siemens security advisory
  • Apply vendor-provided security updates when available per organizational change management procedures
  • Monitor CISA ICS advisories for additional updates to ICSA-25-226-07
  • Implement network segmentation for affected industrial control systems per CISA ICS recommended practices
  • Follow defense-in-depth strategies for industrial control systems environments

Evidence notes

Source data indicates this vulnerability was initially published by CISA on August 12, 2025 as part of ICSA-25-226-07, with subsequent updates on February 12, 2026 (product list corrections), February 24, 2026 (configuration clarifications and rejected CVE removal), and February 25, 2026 (CISA republication based on Siemens SSA-355557). The source advisory marks the threat impact as 'Misinformed' for affected products. No CVSS vector or score is provided in the available source data.

Official resources

2025-08-12