PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-45490 Siemens CVE debrief

CVE-2024-45490 is a critical libexpat parsing flaw described by Siemens and CISA for affected industrial products, including RUGGEDCOM RST2428P (6GK6242-6PA00). The advisory states that xmlparse.c does not reject a negative length for XML_ParseBuffer in libexpat versions before 2.6.3. The published CVSS vector is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so organizations should treat exposed or operationally important installations as high priority. Siemens’ remediation guidance is to update to V3.1 or later for the affected products named in the advisory.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Operators and maintainers of Siemens industrial products named in the advisory, especially RUGGEDCOM RST2428P deployments, should care most. Security teams that manage embedded third-party libraries such as libexpat in industrial control environments should also review their exposure.

Technical summary

The issue is in libexpat before 2.6.3: xmlparse.c does not reject a negative length passed to XML_ParseBuffer. Siemens and CISA map the issue to affected product lines in the SSA-613116 / ICSA-25-226-15 advisory set. The advisory includes product-specific remediation and later republication updates, indicating the affected-product list was refined over time.

Defensive priority

High

Recommended defensive actions

  • Upgrade affected Siemens products to V3.1 or later, following Siemens ProductCERT guidance.
  • Inventory any Siemens devices or embedded applications that bundle libexpat and confirm whether they are in an affected version range.
  • Prioritize internet-exposed or operationally critical installations for patching and validation.
  • Review the advisory revision history to ensure you are using the latest affected-product and remediation information.
  • Use standard ICS defense-in-depth practices to reduce exposure while patching is planned or underway.

Evidence notes

The source advisory was published on 2025-08-12 and later revised, with a final CISA republication update on 2026-02-25 based on Siemens ProductCERT SSA-613116. The advisory explicitly names RUGGEDCOM RST2428P (6GK6242-6PA00) and documents the underlying libexpat issue before 2.6.3. The published CVSS vector is 9.8 and the source bundle includes Siemens advisory links, the CISA ICS advisory, the CVE record, and ICS defensive-practices references.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-45490 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-45490

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-45490 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-45490

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.