PatchSiren cyber security CVE debrief

CVE-2024-50179 Siemens CVE debrief

CVE-2024-50179 is a medium-severity vulnerability (CVSS 5.5) affecting the Ceph distributed storage system, specifically involving an incorrect Fw reference check when dirtying pages. This flaw could lead to availability impacts on affected systems. The vulnerability was published on August 12, 2025, and most recently modified on February 25, 2026. Siemens has identified this vulnerability as affecting multiple industrial networking product families: RUGGEDCOM RST2428P (6GK6242-6PA00), SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family. The issue stems from a third-party Linux kernel component (Ceph) used within Siemens' SINEC OS. For the RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family, Siemens recommends updating to version 3.2 or later. For the SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, affected configurations should be updated to version 3.2 or later as well. The CVSS vector indicates a local attack vector with low attack complexity, requiring low privileges and no user interaction, resulting in high availability impact with no confidentiality or integrity impact.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens industrial networking infrastructure including RUGGEDCOM RST2428P switches and SCALANCE XC/XR/XCM/XRM/XCH/XRH series devices. OT security teams managing critical infrastructure, manufacturing environments, and industrial control systems that rely on these network components. System administrators responsible for firmware maintenance and vulnerability management in operational technology environments.

Technical summary

CVE-2024-50179 is a vulnerability in the Ceph distributed storage system's page dirtying mechanism, where an incorrect Fw (forward) reference check could allow improper memory page handling. The vulnerability is rated CVSS 3.1 5.5 (MEDIUM) with a local attack vector, low attack complexity, and low privilege requirements. The primary impact is to system availability (high), with no confidentiality or integrity impacts. The vulnerability affects Siemens industrial networking products running SINEC OS that incorporate the vulnerable Ceph component. Attackers with local access and low privileges could potentially trigger denial-of-service conditions. The exploitability is rated as unproven (E:U) with an official fix available (RL:O).

Defensive priority

medium

Recommended defensive actions

Apply vendor-provided firmware updates to version 3.2 or later for affected RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
Review Siemens ProductCERT advisory SSA-355557 for specific configuration guidance on affected SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family deployments
Implement defense-in-depth strategies for industrial control systems as recommended by CISA
Monitor CISA ICS advisories for additional updates to this vulnerability
Restrict local access to affected devices to authorized personnel only

Evidence notes

Vulnerability description and affected products confirmed through CISA CSAF advisory ICSA-25-226-07, which references Siemens ProductCERT advisory SSA-355557. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector with high availability impact. Remediation guidance specifies vendor fix through firmware updates to version 3.2 or later for affected product families.

Official resources

2025-08-12