Eine Schwachstelle wurde in RUGGEDCOM RST2428P (6GK6242-6PA00) (Alle Versionen < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (Alle Versionen < V3.1), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All

The buffer overflow vulnerability in Siemens SCALANCE/RUGGEDCOM devices allows an attacker to potentially execute arbitrary code on the affected device. This could lead to complete system compromise, allowing the attacker to modify configurations, steal sensitive data, or disrupt operations. Given the devices' role in industrial control systems, exploitation could have significant consequences, including production downtime, safety hazards, and potential damage to equipment. The impact is amplified if these devices are exposed to untrusted networks or lack proper segmentation.

Organizations utilizing Siemens SCALANCE and RUGGEDCOM devices in industrial control systems, manufacturing plants, or critical infrastructure are at significant risk. Specifically, deployments relying on legacy configurations or those with limited network segmentation are particularly vulnerable. Shared hosting environments where multiple tenants share the same physical infrastructure are also at increased risk, as a compromise of one device could potentially impact others.

• linux / server:

journalctl -u rudgcomd --since "1 hour ago" | grep -i "buffer overflow"

• siemens / supply-chain:

Get-WinEvent -LogName Security -FilterXPath "/Event[System[Provider[@Name='Siemens RUGGEDCOM']]]" | Select-String -Pattern "buffer overflow"

• generic web:

curl -I <device_ip>/status | grep -i "Siemens SCALANCE"

1. 2025-06-10Disclosure

   disclosure

2. 2025-06-10Patch

   patch

1. Reserviert2024-07-22
2. Veröffentlicht2025-06-10
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-41797 is to upgrade affected Siemens SCALANCE/RUGGEDCOM devices to version V3.1 or later. If an immediate upgrade is not feasible due to compatibility concerns or system downtime requirements, consider implementing temporary workarounds such as restricting network access to the devices, enabling strict firewall rules to limit incoming traffic, and monitoring network traffic for suspicious activity. Consult Siemens documentation for specific configuration recommendations. After upgrading, verify the fix by attempting to trigger the vulnerability with a known exploit vector and confirming it is no longer successful.