Remote Code Execution Risk in RUGGEDCOM ROS by Siemens
CVE-2021-31895

9.8CRITICAL

Key Information:

Vendor
Siemens
Status
Ruggedcom Ros M2100
Ruggedcom Ros M2200
Ruggedcom Ros M969
Ruggedcom Ros Rmc
Vendor
CVE Published:
13 July 2021

Summary

A significant vulnerability has been found in multiple versions of Siemens RUGGEDCOM ROS. Specifically, the DHCP client within these devices inadequately sanitizes incoming DHCP packets. This weakness allows malicious actors to craft malicious DHCP packets that, when processed by the affected devices, can lead to memory corruption. The exploit could potentially enable unauthorized remote code execution, compromising the security and integrity of the affected network devices.

Affected Version(s)

RUGGEDCOM ROS i800 All versions < V4.3.7

RUGGEDCOM ROS i801 All versions < V4.3.7

RUGGEDCOM ROS i802 All versions < V4.3.7

References

https://cert-portal.siemens.com/productcert/pdf/ssa-37359...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.