CVE-2024-50559: Siemens Ruggedcom Path Traversal Flaw

CVE-2024-50559 Overview

Siemens disclosed CVE-2024-50559, a path traversal vulnerability [CWE-22] affecting a broad set of SCALANCE M-series routers, SCALANCE S615 security appliances, SCALANCE MUM cellular routers, and RUGGEDCOM RM1224 LTE gateways. The affected devices fail to properly validate certificate filenames supplied during administrative operations. An authenticated remote attacker can append arbitrary values to filenames, leading to integrity compromise on the device. Siemens addressed the issue in firmware V8.2 across all impacted product lines, as documented in Siemens Security Advisory SSA-354112.

Critical Impact
Authenticated remote attackers can manipulate certificate filenames to write unexpected values on the device file system, undermining integrity controls on industrial network infrastructure.

Affected Products

RUGGEDCOM RM1224 LTE(4G) EU/NAM gateways (firmware versions prior to V8.2)
SCALANCE M804PB, M812-1, M816-1, M826-2, M874, M876, and MUM853/856 cellular and DSL routers (firmware versions prior to V8.2)
SCALANCE S615 and S615 EEC LAN-Routers (firmware versions prior to V8.2)

Discovery Timeline

2024-11-12 - CVE-2024-50559 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50559

Vulnerability Analysis

The flaw is a path traversal weakness in the handling of certificate filenames on the device management interface. When an authenticated user uploads or references a certificate, the firmware does not strictly validate the supplied filename. An attacker can append arbitrary values to the filename and influence how the certificate is stored or referenced on the device. Because SCALANCE and RUGGEDCOM devices sit at the perimeter of industrial networks and act as VPN endpoints, firewalls, and cellular gateways, any tampering with certificate storage directly undermines the integrity assumptions of the connected OT environment.

The vulnerability requires network reachability to the device management plane and valid credentials. Exploitation does not require elevated privileges beyond a standard authenticated session but does require user interaction, according to the published vector.

Root Cause

The root cause is insufficient input validation on certificate filename fields, mapped to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The firmware accepts filename strings without canonicalizing them or restricting characters that could alter the storage path. As a result, appended values become part of the stored filename, enabling an attacker to overwrite, shadow, or create unexpected entries in the certificate store.

Attack Vector

An attacker with valid credentials to the web management interface submits a crafted certificate upload or configuration request containing a filename with appended traversal or special characters. The firmware stores the certificate under the attacker-controlled name. The attacker can then influence which certificate is presented or trusted during subsequent operations, breaking the integrity of trust decisions on the device. No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Siemens Security Advisory SSA-354112 for vendor-provided technical details.

Detection Methods for CVE-2024-50559

Indicators of Compromise

Certificate files on the device with unexpected names, path separators, or appended characters outside the normal naming convention.
Administrative login events on the SCALANCE or RUGGEDCOM web interface followed by certificate upload or configuration-change actions from unexpected source IP addresses.
Device event log entries referencing certificate import or storage operations that do not match an approved change window.

Detection Strategies

Collect SCALANCE and RUGGEDCOM syslog output and alert on certificate management events, especially those outside approved maintenance windows.
Periodically export the device certificate inventory and compare filenames against an allowlist generated from the current approved configuration.
Monitor HTTPS management traffic to affected device IP ranges for authenticated sessions that submit certificate upload requests, and correlate with change tickets.

Monitoring Recommendations

Forward device audit logs to a centralized SIEM or data lake and build identifications around unexpected administrative activity on OT management interfaces.
Baseline authorized administrator accounts and source networks that may access the device management plane, and alert on deviations.
Track firmware versions across the SCALANCE, MUM, S615, and RUGGEDCOM RM1224 fleet to confirm all units have been upgraded to V8.2 or later.

How to Mitigate CVE-2024-50559

Immediate Actions Required

Upgrade all affected SCALANCE M-series, SCALANCE S615, SCALANCE MUM, and RUGGEDCOM RM1224 devices to firmware V8.2 or later.
Restrict access to device management interfaces to a dedicated administrative VLAN or jump host, following Siemens' operational guidelines for industrial security.
Rotate administrative credentials on affected devices and audit the active certificate store for unexpected entries.

Patch Information

Siemens has released firmware V8.2 for every affected product listed in Siemens Security Advisory SSA-354112. Operators should plan maintenance windows to apply the firmware across all RUGGEDCOM RM1224, SCALANCE M-series, SCALANCE MUM, and SCALANCE S615 units. Verify firmware integrity using Siemens-provided signatures before deployment.

Workarounds

Limit management interface exposure to trusted engineering workstations using firewall rules on upstream network equipment.
Enforce strong authentication and disable unused administrative accounts on the affected devices.
Apply network segmentation per IEC 62443 to isolate OT devices from general enterprise networks until patching is complete.

bash

# Example: restrict access to SCALANCE/RUGGEDCOM web management
# (apply on upstream firewall or ACL, replace addresses as needed)
iptables -A FORWARD -p tcp -s 10.10.50.0/24 -d 192.0.2.10 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP