PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-49930 Siemens CVE debrief

CVE-2024-49930 is an array out-of-bounds access vulnerability in the Linux kernel's ath11k Wi-Fi driver, specifically affecting the ath11k_soc_dp_stats::hal_reo_error array. The vulnerability stems from incorrect indexing in the ath11k_dp_process_rx() function, which uses the REO destination SRNG ring ID instead of the normal ring ID. Since SRNG ring IDs differ from normal ring IDs, this leads to out-of-bounds array access when processing receive packets. The vulnerability was published on August 12, 2025, and last modified on February 25, 2026. Siemens has identified this CVE as affecting certain industrial networking products, including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices, which incorporate the vulnerable third-party Linux kernel component. The vulnerability is classified under CWE-125 (Out-of-bounds Read). While the underlying vulnerability exists in the Linux kernel's ath11k driver, Siemens products that include this component may be exposed if the Wi-Fi functionality is enabled and configured in a manner that triggers the vulnerable code path. The vulnerability requires local network access to exploit, as it involves processing of Wi-Fi receive packets.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens industrial networking equipment with Wi-Fi capabilities, particularly in critical infrastructure and OT environments. Security teams responsible for patch management of Linux-based industrial devices. Network administrators managing RUGGEDCOM and SCALANCE wireless infrastructure. ICS/SCADA security practitioners monitoring for kernel-level vulnerabilities in embedded industrial systems.

Technical summary

CVE-2024-49930 is an out-of-bounds array access vulnerability in the Linux kernel's ath11k Wi-Fi driver. The ath11k_soc_dp_stats structure contains a hal_reo_error array sized to DP_REO_DST_RING_MAX elements. However, the ath11k_dp_process_rx() function incorrectly indexes this array using the REO destination SRNG (Source Ring) ring ID rather than the normal ring ID. Since SRNG ring IDs have different value ranges than normal ring IDs, this indexing error can result in out-of-bounds memory access during receive packet processing. The vulnerability affects Qualcomm Atheros 802.11ax Wi-Fi chipsets supported by the ath11k driver. Siemens industrial networking products incorporating this driver component are affected, including RUGGEDCOM RST2428P and select SCALANCE product families. The vulnerability is exploitable by an attacker with the ability to send crafted Wi-Fi traffic that triggers the vulnerable receive processing path. Successful exploitation could lead to memory corruption, denial of service, or potentially information disclosure depending on the memory layout and system configuration.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for specific product impact and patch availability
  • Verify if affected Siemens products have Wi-Fi functionality enabled and in use
  • Apply kernel updates or vendor-provided firmware patches that include the ath11k driver fix
  • Monitor network traffic for anomalous Wi-Fi activity that could indicate exploitation attempts
  • Implement network segmentation to limit exposure of industrial Wi-Fi infrastructure
  • Follow CISA ICS recommended practices for defense-in-depth security controls

Evidence notes

The vulnerability description is derived from the CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. The technical details indicate this is a Linux kernel ath11k driver issue where the ath11k_dp_process_rx() function incorrectly uses SRNG ring ID for array indexing. The source advisory indicates this CVE was initially included in the affected products list but subsequent revisions have adjusted product categorization. The February 25, 2026 revision represents the latest CISA republication based on updated Siemens guidance.

Official resources

2025-08-12