CVE-2024-49858 Siemens CVE debrief

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 industrial networking devices in critical infrastructure environments. Security teams managing OT/ICS networks where kexec-based kernel updates or high-availability configurations are deployed. System administrators responsible for firmware maintenance and TPM-enabled secure boot implementations in industrial automation environments.

Technical summary

The vulnerability exists in the Linux kernel's EFI stub implementation where the TPM event log table is allocated using EFI_LOADER_DATA memory type rather than ACPI reclaim memory. This causes the region to remain unreserved in the E820 memory map passed to kexec-loaded kernels. When kexec transfers control to a new kernel, the incoming kernel lacks awareness that this memory region should be reserved, permitting potential corruption of the TPM2 event log data. While the practical utility of the TPM2 event log after kexec is limited, corruption of this data structure can cause the kernel's parsing code to access invalid memory regions, resulting in kernel crashes and system instability. The attack requires local access with low privileges and no user interaction, making it primarily relevant in multi-user or compromised scenarios on affected industrial devices running vulnerable SINEC OS versions.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM and SCALANCE product families
• Review kexec configurations on affected devices and consider disabling if TPM event log integrity is critical
• Monitor for unexpected kernel crashes or system instability that may indicate exploitation attempts
• Implement defense-in-depth strategies per CISA ICS recommended practices for industrial control systems
• Verify memory reservation configurations in EFI boot environments where kexec is utilized

Evidence notes

The vulnerability was disclosed in CISA advisory ICSA-25-226-07 on 2025-08-12, with subsequent modifications through 2026-02-25. Siemens ProductCERT published SSA-355557 to address this and related third-party component vulnerabilities in SINEC OS. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms local attack vector with low complexity and high availability impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.