Read the docs
TI-2024-27842 Aliases CVE-2024-41797GHSA-4fhp-55v2-x26m

Improper privilege management in Siemens RUGGEDCOM RST2428P

Priority LOW 24CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.1), SCALANCE XC332 (6GK5332-0GA00-2AC2) (All versions < V3.1), SCALANCE XC416-8 (6GK5424-8TR00-2AC2) (All versions < V3.1), SCALANCE XC424-4 (6GK5428-4TR00-2AC2) (All versions < V3.1), SCALANCE XC432 (6GK5432-0GR00-2AC2) (All versions < V3.1), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.1), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.1), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.1), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-3AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-4AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-2AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-3AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-4AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-2AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-3AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-4AR3) (All versions < V3.1), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-3AR3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-4AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-2AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-3AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-4AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-2AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-3AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-4AR3) (All versions < V3.1), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.1), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.1), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.1). Affected devices contain an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to invoke an internal "do system" command which exceeds their privileges. This command allows the execution of certain low-risk actions, the most critical of which is clearing the local system log.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed RUGGEDCOM RST2428P (Siemens): V3.1SCALANCE XC316-8 (Siemens): V3.1+27 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensRUGGEDCOM RST2428Pbefore V3.1V3.1Patch availableCNA
SiemensSCALANCE XC316-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XC324-4before V3.1V3.1Patch availableCNA
SiemensSCALANCE XC324-4 EECbefore V3.1V3.1Patch availableCNA
SiemensSCALANCE XC332before V3.1V3.1Patch availableCNA
SiemensSCALANCE XC416-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XC424-4before V3.1V3.1Patch availableCNA
SiemensSCALANCE XC432before V3.1V3.1Patch availableCNA
SiemensSCALANCE XCH328before V3.1V3.1Patch availableCNA
SiemensSCALANCE XCM324before V3.1V3.1Patch availableCNA
SiemensSCALANCE XCM328before V3.1V3.1Patch availableCNA
SiemensSCALANCE XCM332before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR302-32before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR302-32before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR302-32before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR322-12before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR322-12before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR322-12before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR326-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR326-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR326-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR326-8 EECbefore V3.1V3.1Patch availableCNA
SiemensSCALANCE XR502-32before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR502-32before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR502-32before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR522-12before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR522-12before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR522-12before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR526-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR526-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XR526-8before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRH334 (24 V DC, 8xFO, CC)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (230 V AC, 12xFO)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (230 V AC, 8xFO)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (24 V DC, 12xFO)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (24 V DC, 8xFO)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (2x230 V AC, 12xFO)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (2x230 V AC, 8xFO)before V3.1V3.1Patch availableCNA
SiemensSCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)before V3.1V3.1Patch availableCNA
  • RUGGEDCOM RST2428P VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC316-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC324-4 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC324-4 EEC VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC332 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC416-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC424-4 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XC432 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XCH328 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XCM324 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XCM328 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XCM332 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR302-32 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR302-32 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR302-32 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR322-12 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR322-12 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR322-12 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR326-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR326-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR326-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR326-8 EEC VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR502-32 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR502-32 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR502-32 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR522-12 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR522-12 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR522-12 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR526-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR526-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XR526-8 VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRH334 (24 V DC, 8xFO, CC) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (230 V AC, 12xFO) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (230 V AC, 8xFO) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (24 V DC, 12xFO) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (24 V DC, 8xFO) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (2x230 V AC, 12xFO) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (2x230 V AC, 8xFO) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA
  • SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) VendorSiemens Affected before V3.1 Fixed in V3.1 Patch available CNA

Remediation

  • Fix · CNA RUGGEDCOM RST2428P (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC316-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC324-4 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC324-4 EEC (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC332 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC416-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC424-4 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XC432 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XCH328 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XCM324 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XCM328 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XCM332 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR302-32 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR302-32 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR302-32 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR322-12 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR322-12 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR322-12 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR326-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR326-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR326-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR326-8 EEC (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR502-32 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR502-32 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR502-32 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR522-12 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR522-12 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR522-12 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR526-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR526-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XR526-8 (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRH334 (24 V DC, 8xFO, CC) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (230 V AC, 12xFO) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (230 V AC, 8xFO) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (24 V DC, 12xFO) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (24 V DC, 8xFO) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (2x230 V AC, 12xFO) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (2x230 V AC, 8xFO) (Siemens) Fixed in V3.1
  • Fix · CNA SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (Siemens) Fixed in V3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41797
  2. 2026-10-03 Alias added: GHSA-4fhp-55v2-x26m

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences