PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50295 Siemens CVE debrief

A vulnerability in the ARCnet network driver (net: arc) of the Linux kernel generates a warning condition when the network device structure (ndev->dev) and platform device structure (pdev->dev) reference different devices. This condition can lead to local denial of service through system instability or warning floods. The vulnerability requires local access with low privileges and no user interaction. Siemens has identified affected products in their industrial networking equipment portfolio running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P or SCALANCE X-family industrial Ethernet switches in critical infrastructure environments. OT security teams managing SINEC OS deployments. Asset owners requiring CISA-tracked vulnerability remediation for compliance purposes. Network administrators responsible for ARCnet legacy network segments in industrial environments. Security operations centers monitoring for Linux kernel driver anomalies in embedded industrial systems. Compliance teams tracking CVE-2024 disclosures for patch management programs. Industrial control system integrators deploying Siemens networking equipment in manufacturing, energy, or transportation sectors.

Technical summary

The vulnerability exists in the ARCnet (Attached Resource Computer Network) driver within the Linux kernel networking subsystem. The driver generates a warning when the network device structure's embedded device pointer (ndev->dev) does not match the platform device structure's device pointer (pdev->dev). This device mismatch warning can be triggered to cause local denial of service conditions. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local attack vector, low attack complexity, low privilege requirements, and high availability impact. No confidentiality or integrity impacts are associated with this vulnerability. Siemens ProductCERT has confirmed affected status for specific industrial Ethernet switch models running SINEC OS, with remediation through firmware updates to version 3.2 or later.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates to V3.2 or later for affected RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT advisory SSA-355557 for specific configuration guidance and patch availability
  • Implement network segmentation for industrial control systems to limit local access vectors
  • Monitor system logs for ARCnet driver warnings indicating potential exploitation attempts
  • Follow CISA ICS recommended practices for defense-in-depth strategies
  • Restrict local access to industrial network devices to authorized personnel only

Evidence notes

CVE published 2025-08-12. CISA advisory ICSA-25-226-07 published same date. Siemens ProductCERT advisory SSA-355557 referenced as authoritative source. Advisory modified 2026-02-25 with republication based on Siemens update. CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scoring 5.5 MEDIUM. CWE-20 (Improper Input Validation) associated.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50295 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50295

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50295 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50295

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.