PatchSiren cyber security CVE debrief

CVE-2024-49957 Siemens CVE debrief

CVE-2024-49957 is a null pointer dereference vulnerability in the OCFS2 (Oracle Cluster File System 2) Linux kernel module, triggered when journal loading fails. The vulnerability was published on August 12, 2025, and last modified on February 25, 2026. Siemens ProductCERT issued advisory SSA-355557 addressing third-party components in SINEC OS, which includes this kernel-level issue. CISA republished the advisory as ICSA-25-226-07 on the same publication date. The vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The source advisory's threat assessment categorizes the impact as 'Misinformed' for affected products. No CVSS score or severity rating is available in the source corpus. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment with SINEC OS, particularly RUGGEDCOM and SCALANCE product lines in critical infrastructure environments. OT security teams responsible for patch management of Linux-based industrial network operating systems.

Technical summary

A null pointer dereference vulnerability exists in the OCFS2 (Oracle Cluster File System 2) Linux kernel module when journal loading fails. This third-party Linux kernel component is incorporated into Siemens SINEC OS, which powers industrial networking devices including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family. The vulnerability is triggered during filesystem journal initialization failure conditions. The source advisory categorizes impact as 'Misinformed' without providing CVSS scoring. The issue was addressed through Siemens ProductCERT advisory SSA-355557 and republished by CISA as ICSA-25-226-07.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-355557 for patch availability and affected product configurations
Verify SINEC OS version on RUGGEDCOM RST2428P and SCALANCE XC/XR family devices
Apply vendor-provided firmware updates when available per Siemens security advisory
Monitor CISA ICS advisories for additional guidance on industrial control system protections
Implement network segmentation for industrial control systems per CISA recommended practices

Evidence notes

Source corpus indicates this CVE originated from Linux kernel OCFS2 filesystem code (null-ptr-deref when journal load failed) and was incorporated into Siemens SINEC OS third-party components. CISA CSAF advisory ICSA-25-226-07 republishes Siemens SSA-355557. Threat impact marked 'Misinformed' per source threats array. No CVSS vector or score present in source. Not in KEV.

Official resources

2025-08-12