PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50251 Siemens CVE debrief

CVE-2024-50251 is a vulnerability in the Linux kernel's netfilter subsystem, specifically within the nft_payload module. The issue occurs when offset and length parameters are not properly sanitized before calling skb_checksum(). If the combined offset and length exceed the actual skbuff (socket buffer) length, skb_checksum() triggers a BUG_ON() assertion, resulting in a kernel crash and denial of service. The vulnerability requires local access with low privileges and has a medium severity CVSS score of 5.5. Siemens has identified affected products in their industrial networking equipment lines, including RUGGEDCOM RST2428P and SCALANCE families, which incorporate the vulnerable Linux kernel components. The vulnerability was published on August 12, 2025, with the advisory last modified on February 25, 2026.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens industrial networking equipment including RUGGEDCOM RST2428P switches and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 and XCM-/XRM-/XCH-/XRH-300 families. System administrators managing Linux-based industrial control systems with nftables enabled. Security teams responsible for OT/ICS network infrastructure availability.

Technical summary

The vulnerability exists in the Linux kernel's netfilter framework, specifically the nft_payload module used for packet payload manipulation in nftables. The function skb_checksum() expects that the length parameter provided will be fully consumed when iterating over the socket buffer. When nft_payload passes unsanitized offset and length values where offset + length exceeds the actual skbuff length, skb_checksum() fails its internal BUG_ON(len) assertion at the end of processing. This results in an immediate kernel panic. The vulnerability is exploitable by local users with the ability to configure nftables rules, requiring only low privileges and no user interaction. The attack complexity is low, with no impact to confidentiality or integrity, but high availability impact due to system crash.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided updates to affected Siemens industrial networking products: update RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.2 or later
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and patch availability
  • Implement network segmentation to limit local access to affected industrial control systems
  • Monitor for unexpected system crashes or reboots in affected Siemens networking equipment that may indicate exploitation attempts
  • Apply principle of least privilege to limit local user access on systems running affected kernel versions

Evidence notes

The vulnerability description is sourced from CISA ICS advisory ICSA-25-226-07, which republishes Siemens ProductCERT advisory SSA-355557. The technical details indicate this is a kernel-level bug in netfilter's nft_payload implementation where insufficient bounds checking leads to a BUG_ON() trigger in skb_checksum() when offset+length exceeds skbuff boundaries.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50251 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50251

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50251 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50251

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.