PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50059 Siemens CVE debrief

A use-after-free vulnerability exists in the Switchtec NTB (Non-Transparent Bridge) driver within the Linux kernel. The flaw occurs in the `switchtec_ntb_remove` function due to a race condition, where memory is accessed after it has been freed. This vulnerability is classified as HIGH severity with a CVSS 3.1 score of 7.1. The vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE switch families. The issue was published on August 12, 2025, with the advisory last modified on February 25, 2026. Siemens has provided vendor fixes through firmware updates to address this vulnerability.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 industrial Ethernet switches in critical infrastructure environments, particularly those in energy, manufacturing, and transportation sectors where these devices are commonly deployed.

Technical summary

The vulnerability exists in the `switchtec_ntb_remove` function of the Switchtec NTB hardware driver. A race condition during device removal can lead to use-after-free memory corruption. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates this requires local access with low privileges but can result in high impact to system integrity and availability. The vulnerability was originally identified in the Linux kernel NTB subsystem and affects Siemens products incorporating the vulnerable component.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM and SCALANCE products as specified in Siemens security advisory
  • Review and implement CISA ICS recommended practices for defense-in-depth strategies
  • Monitor Siemens ProductCERT and CISA ICS advisories for additional updates or clarifications to affected product configurations
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Section Additional Information in the advisory for specific configuration guidance

Evidence notes

Vulnerability description and affected products confirmed through CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H indicates local attack vector with low attack complexity, requiring low privileges but no user interaction, with high impact to integrity and availability.

Official resources

2025-08-12