PatchSiren cyber security CVE debrief

CVE-2024-41035 Siemens CVE debrief

CVE-2024-41035 is a HIGH severity vulnerability (CVSS 7.1) in the USB core subsystem, specifically a duplicate endpoint bug. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. Siemens has identified this vulnerability as affecting their RUGGEDCOM RST2428P (6GK6242-6PA00) product, as documented in CISA advisory ICSA-25-226-07. The advisory has undergone multiple revisions, with the most recent update on 2026-02-25 reflecting republication based on Siemens ProductCERT SSA-355557 advisory. Notably, the threat assessment for this CVE is categorized as 'Misinformed' in the source advisory, indicating potential discrepancies in initial impact assessment. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and there is no indication of known ransomware campaign use. Organizations should consult the Siemens ProductCERT advisory for specific patch and mitigation guidance.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P industrial networking equipment, OT security teams managing USB-connected devices in industrial environments, and infrastructure operators following CISA ICS security advisories.

Technical summary

A vulnerability in the USB core subsystem related to duplicate endpoint handling. The vulnerability affects Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) industrial networking equipment. The source advisory categorizes the threat as 'Misinformed,' suggesting initial impact assessments may have been inaccurate. The vulnerability was disclosed in August 2025 and has been subject to multiple advisory revisions through February 2026.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT SSA-355557 advisory for detailed product-specific guidance
Verify affected product configurations against Siemens documentation
Apply vendor-provided patches when available
Implement defense-in-depth strategies for industrial control systems per CISA recommendations
Monitor CISA ICS advisories for updates to ICSA-25-226-07

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. Source advisory ICSA-25-226-07 from CISA CSAF, with threat category 'Misinformed' per source threats field. Vendor confirmed as Siemens via csaf_product_tree with high confidence. Not in KEV catalog per enrichment data.

Official resources

2025-08-12