PatchSiren cyber security CVE debrief

CVE-2024-41035 Siemens CVE debrief

CVE-2024-41035 is a HIGH severity vulnerability (CVSS 7.1) in the USB core subsystem, specifically a duplicate endpoint bug. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. Siemens has identified this vulnerability as affecting their RUGGEDCOM RST2428P (6GK6242-6PA00) product, as documented in CISA advisory ICSA-25-226-07. The advisory has undergone multiple revisions, with the most recent update on 2026-02-25 reflecting republication based on Siemens ProductCERT SSA-355557 advisory. Notably, the threat assessment for this CVE is categorized as 'Misinformed' in the source advisory, indicating potential discrepancies in initial impact assessment. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and there is no indication of known ransomware campaign use. Organizations should consult the Siemens ProductCERT advisory for specific patch and mitigation guidance.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P industrial networking equipment, OT security teams managing USB-connected devices in industrial environments, and infrastructure operators following CISA ICS security advisories.

Technical summary

A vulnerability in the USB core subsystem related to duplicate endpoint handling. The vulnerability affects Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) industrial networking equipment. The source advisory categorizes the threat as 'Misinformed,' suggesting initial impact assessments may have been inaccurate. The vulnerability was disclosed in August 2025 and has been subject to multiple advisory revisions through February 2026.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT SSA-355557 advisory for detailed product-specific guidance
Verify affected product configurations against Siemens documentation
Apply vendor-provided patches when available
Implement defense-in-depth strategies for industrial control systems per CISA recommendations
Monitor CISA ICS advisories for updates to ICSA-25-226-07

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. Source advisory ICSA-25-226-07 from CISA CSAF, with threat category 'Misinformed' per source threats field. Vendor confirmed as Siemens via csaf_product_tree with high confidence. Not in KEV catalog per enrichment data.

Sources and references

Verified primary and authoritative sources

CVE-2024-41035 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-41035

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-41035 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-41035

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.