PatchSiren cyber security CVE debrief

CVE-2024-49883 Siemens CVE debrief

CVE-2024-49883 is a use-after-free vulnerability in the Linux ext4 filesystem, specifically within the ext4_ext_insert_extent() function. The flaw occurs when ext4_ext_create_new_leaf() reallocates a path structure, but the stale path pointer continues to be used, leading to memory corruption. This vulnerability has been identified as affecting Siemens industrial networking products that incorporate vulnerable Linux kernel versions, including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The vulnerability requires local access with low privileges to exploit, and successful exploitation results in high availability impact (system crash or denial of service) with no confidentiality or integrity impact. Siemens has released firmware updates to address this issue, with V3.2 or later versions containing the fix. The vulnerability was initially published on August 12, 2025, and the advisory was subsequently updated on February 25, 2026, to reflect corrections to affected product listings and additional clarifications.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family industrial Ethernet switches in operational technology (OT) environments. System administrators responsible for firmware lifecycle management in industrial control systems. Security teams monitoring for local privilege escalation or denial-of-service vectors in embedded Linux systems.

Technical summary

The vulnerability exists in the ext4 filesystem implementation where ext4_ext_insert_extent() fails to properly handle path reallocation by ext4_ext_create_new_leaf(). When the path structure is reallocated, the original pointer becomes stale, yet continues to be dereferenced, resulting in a use-after-free condition. This memory safety defect can be triggered by local users with low privileges and leads to kernel crashes or denial of service conditions. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local attack vector and high availability impact with no confidentiality or integrity consequences.

Defensive priority

medium

Recommended defensive actions

Update affected Siemens RUGGEDCOM RST2428P and SCALANCE devices to firmware version V3.2 or later
Review Siemens ProductCERT advisory SSA-355557 for specific configuration guidance regarding SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices
Apply defense-in-depth strategies for industrial control systems as recommended by CISA
Monitor for anomalous local activity on affected devices that could indicate exploitation attempts
Validate firmware integrity after updates through vendor-provided checksums or signatures

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. CVSS vector confirms local attack vector with low attack complexity and low privileges required. Affected products identified through CSAF product tree with high confidence. Remediation guidance specifies firmware version V3.2 or later as the vendor fix.

Sources and references

Verified primary and authoritative sources

CVE-2024-49883 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-49883

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-49883 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-49883

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.