PatchSiren cyber security CVE debrief

CVE-2024-50045 Siemens CVE debrief

A vulnerability in the Linux kernel's netfilter br_netfilter subsystem could cause a kernel panic when processing skbs with metadata_dst. This affects Siemens industrial networking products running SINEC OS. The issue has been resolved in the upstream Linux kernel. Siemens has released updates to address this vulnerability in affected RUGGEDCOM and SCALANCE product families.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-09
Original CVE updated: 2026-05-14
Advisory published: 2024-04-09
Advisory updated: 2026-05-14

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P switches or SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 family industrial Ethernet switches in critical infrastructure, manufacturing, or utility environments. System administrators responsible for industrial control system network security and availability.

Technical summary

The vulnerability exists in the Linux kernel's netfilter bridge netfilter (br_netfilter) subsystem. When processing socket buffers (skbs) containing metadata_dst structures, improper handling could trigger a kernel panic. This represents a local denial-of-service condition with availability impact. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. Affected Siemens products incorporate the vulnerable Linux kernel component through SINEC OS.

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided firmware updates: update RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.2 or later per Siemens guidance
For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens advisory for specific configuration guidance and update path
Implement network segmentation for industrial control systems to limit exposure of affected devices
Monitor for anomalous system behavior or unexpected reboots that may indicate kernel panic conditions
Review CISA ICS recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

CVE published 2025-08-12. CISA advisory ICSA-25-226-07 published same date. Siemens ProductCERT advisory SSA-355557 referenced as authoritative source. Advisory modified 2026-02-25 with republication based on Siemens update. CVSS 5.5 (MEDIUM) per source. CWE-476 (NULL Pointer Dereference) indicated by reference.

Official resources

2025-08-12