Skip to content
Fencer Vulns
medium 4.3

CVE-2024-41797 json

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All…

published 2025-06-10 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-54662

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.1), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.1), SCALANCE XC332 (6GK5332-0GA00-2AC2) (All versions < V3.1), SCALANCE XC416-8 (6GK5424-8TR00-2AC2) (All versions < V3.1), SCALANCE XC424-4 (6GK5428-4TR00-2AC2) (All versions < V3.1), SCALANCE XC432 (6GK5432-0GR00-2AC2) (All versions < V3.1), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.1), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.1), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.1), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-3AR3) (All versions < V3.1), SCALANCE XR302-32 (6GK5334-5TS00-4AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-2AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-3AR3) (All versions < V3.1), SCALANCE XR322-12 (6GK5334-3TS00-4AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-2AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-3AR3) (All versions < V3.1), SCALANCE XR326-8 (6GK5334-2TS00-4AR3) (All versions < V3.1), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-3AR3) (All versions < V3.1), SCALANCE XR502-32 (6GK5534-5TR00-4AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-2AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-3AR3) (All versions < V3.1), SCALANCE XR522-12 (6GK5534-3TR00-4AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-2AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-3AR3) (All versions < V3.1), SCALANCE XR526-8 (6GK5534-2TR00-4AR3) (All versions < V3.1), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.1), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.1), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.1), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.1), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.1). Affected devices contain an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to invoke an internal "do system" command which exceeds their privileges. This command allows the execution of certain low-risk actions, the most critical of which is clearing the local system log.

Patch / fix

  • Siemens RUGGEDCOM RST2428P V3.1
  • Siemens SCALANCE XC316-8 V3.1
  • Siemens SCALANCE XC324-4 V3.1
  • Siemens SCALANCE XC324-4 EEC V3.1
  • Siemens SCALANCE XC332 V3.1
  • Siemens SCALANCE XC416-8 V3.1
  • Siemens SCALANCE XC424-4 V3.1
  • Siemens SCALANCE XC432 V3.1
  • Siemens SCALANCE XCH328 V3.1
  • Siemens SCALANCE XCM324 V3.1
  • Siemens SCALANCE XCM328 V3.1
  • Siemens SCALANCE XCM332 V3.1
  • Siemens SCALANCE XR302-32 V3.1
  • Siemens SCALANCE XR322-12 V3.1
  • Siemens SCALANCE XR326-8 V3.1
  • Siemens SCALANCE XR326-8 EEC V3.1
  • Siemens SCALANCE XR502-32 V3.1
  • Siemens SCALANCE XR522-12 V3.1
  • Siemens SCALANCE XR526-8 V3.1
  • Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) V3.1
  • Siemens SCALANCE XRM334 (230 V AC, 12xFO) V3.1
  • Siemens SCALANCE XRM334 (230 V AC, 8xFO) V3.1
  • Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) V3.1
  • Siemens SCALANCE XRM334 (24 V DC, 12xFO) V3.1
  • Siemens SCALANCE XRM334 (24 V DC, 8xFO) V3.1
  • Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) V3.1
  • Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) V3.1
  • Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) V3.1
  • Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) V3.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-162-03 updated cvss 4.3

Siemens SCALANCE and RUGGEDCOM

  • Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < V3.1 Siemens SCALANCE XC316-8 (6GK5324-8TS00-2AC2) < V3.1 Siemens SCALANCE XC324-4 (6GK5328-4TS00-2AC2) < V3.1 Siemens SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) < V3.1 Siemens SCALANCE XC332 (6GK5332-0GA00-2AC2) < V3.1 Siemens SCALANCE XC416-8 (6GK5424-8TR00-2AC2) < V3.1
    +34 more products
    Siemens SCALANCE XC424-4 (6GK5428-4TR00-2AC2) < V3.1 Siemens SCALANCE XC432 (6GK5432-0GR00-2AC2) < V3.1 Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) < V3.1 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) < V3.1 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) < V3.1 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) < V3.1 Siemens SCALANCE XR302-32 (6GK5334-5TS00-2AR3) < V3.1 Siemens SCALANCE XR302-32 (6GK5334-5TS00-3AR3) < V3.1 Siemens SCALANCE XR302-32 (6GK5334-5TS00-4AR3) < V3.1 Siemens SCALANCE XR322-12 (6GK5334-3TS00-2AR3) < V3.1 Siemens SCALANCE XR322-12 (6GK5334-3TS00-3AR3) < V3.1 Siemens SCALANCE XR322-12 (6GK5334-3TS00-4AR3) < V3.1 Siemens SCALANCE XR326-8 (6GK5334-2TS00-2AR3) < V3.1 Siemens SCALANCE XR326-8 (6GK5334-2TS00-3AR3) < V3.1 Siemens SCALANCE XR326-8 (6GK5334-2TS00-4AR3) < V3.1 Siemens SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) < V3.1 Siemens SCALANCE XR502-32 (6GK5534-5TR00-2AR3) < V3.1 Siemens SCALANCE XR502-32 (6GK5534-5TR00-3AR3) < V3.1 Siemens SCALANCE XR502-32 (6GK5534-5TR00-4AR3) < V3.1 Siemens SCALANCE XR522-12 (6GK5534-3TR00-2AR3) < V3.1 Siemens SCALANCE XR522-12 (6GK5534-3TR00-3AR3) < V3.1 Siemens SCALANCE XR522-12 (6GK5534-3TR00-4AR3) < V3.1 Siemens SCALANCE XR526-8 (6GK5534-2TR00-2AR3) < V3.1 Siemens SCALANCE XR526-8 (6GK5534-2TR00-3AR3) < V3.1 Siemens SCALANCE XR526-8 (6GK5534-2TR00-4AR3) < V3.1 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) < V3.1 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) < V3.1 Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) < V3.1 Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) < V3.1 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) < V3.1 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) < V3.1 Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) < V3.1 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) < V3.1 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) < V3.1
    affected: fixed in V3.1 support.industry.siemens.com

1 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Siemens RUGGEDCOM RST2428P
  • Siemens SCALANCE XC316-8
  • Siemens SCALANCE XC324-4
  • Siemens SCALANCE XC324-4 EEC
  • Siemens SCALANCE XC332
  • Siemens SCALANCE XC416-8
  • Siemens SCALANCE XC424-4
  • Siemens SCALANCE XC432
  • Siemens SCALANCE XCH328
  • Siemens SCALANCE XCM324
  • Siemens SCALANCE XCM328
  • Siemens SCALANCE XCM332
  • Siemens SCALANCE XR302-32
  • Siemens SCALANCE XR322-12
  • Siemens SCALANCE XR326-8
  • Siemens SCALANCE XR326-8 EEC
  • Siemens SCALANCE XR502-32
  • Siemens SCALANCE XR522-12
  • Siemens SCALANCE XR526-8
  • Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC)
  • Siemens SCALANCE XRM334 (230 V AC, 12xFO)
  • Siemens SCALANCE XRM334 (230 V AC, 8xFO)
  • Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)
  • Siemens SCALANCE XRM334 (24 V DC, 12xFO)
  • Siemens SCALANCE XRM334 (24 V DC, 8xFO)
  • Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)
  • Siemens SCALANCE XRM334 (2x230 V AC, 12xFO)
  • Siemens SCALANCE XRM334 (2x230 V AC, 8xFO)
  • Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.