CVE-2024-50195 Siemens CVE debrief

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500, or SCALANCE XCM-/XRM-/XCH-/XRH-300 industrial networking equipment in critical infrastructure environments, including energy, manufacturing, and transportation sectors.

Technical summary

The Linux kernel's posix-clock subsystem contains a vulnerability in pc_clock_settime() where timespec64 structure values are not validated before use. This missing check can be exploited by a local attacker with low privileges to cause a denial-of-service condition. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. The vulnerability affects Siemens industrial networking products including RUGGEDCOM RST2428P and SCALANCE switch families when running affected versions of SINEC OS.

Defensive priority

medium

Recommended defensive actions

• Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
• For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and update instructions
• Implement network segmentation to limit local access to affected industrial control systems
• Monitor for anomalous system behavior or unexpected reboots on affected devices
• Follow CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

The vulnerability is documented in CISA ICS advisory ICSA-25-226-07, which was initially published on 2025-08-12 and subsequently updated on 2026-02-25 to reflect corrections to affected products and republication based on Siemens ProductCERT SSA-355557. The advisory identifies this as a Linux kernel posix-clock issue affecting Siemens industrial networking products running SINEC OS.

Official resources