Weak Cipher Configuration in RUGGEDCOM ROX Devices by Siemens
CVE-2023-36748

5.9MEDIUM

Key Information:

Vendor
Siemens
Status
Ruggedcom Rox Mx5000
Ruggedcom Rox Mx5000re
Ruggedcom Rox Rx1400
Ruggedcom Rox Rx1500
Vendor
CVE Published:
11 July 2023

Summary

A significant vulnerability has been found in RUGGEDCOM ROX devices that are configured to offer weak ciphers by default. This issue may allow an unauthorized attacker to place themselves in a man-in-the-middle position, facilitating the reading and modification of sensitive data transmitted to and from the affected devices. Users of RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 models are advised to upgrade to version 2.16.0 or later to mitigate potential risks.

Affected Version(s)

RUGGEDCOM ROX MX5000 All versions < V2.16.0

RUGGEDCOM ROX MX5000RE All versions < V2.16.0

RUGGEDCOM ROX RX1400 All versions < V2.16.0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-14632...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.