Cross-Site Request Forgery Vulnerability in RUGGEDCOM ROX Products by Siemens

CVE-2022-29561

Summary

A vulnerability exists in the web interface of various RUGGEDCOM ROX devices manufactured by Siemens, affecting all versions prior to V2.16.0. This flaw allows attackers to exploit Cross-Site Request Forgery (CSRF) attacks, where they can trick authenticated users into unwittingly executing arbitrary actions on their devices. By persuading users to click on malicious links, threat actors can bypass standard authentication protocols and manipulate device configurations, potentially leading to unauthorized access and control.

References