Code Execution Vulnerability in RUGGEDCOM and SCALANCE Products
CVE-2023-44317

7.2HIGH

Key Information:

Vendor
Siemens
Status
Ruggedcom Rm1224 Lte(4g) Eu
Ruggedcom Rm1224 Lte(4g) Nam
Scalance M804pb
Scalance M812-1 Adsl-router
Vendor
CVE Published:
14 November 2023

Summary

This vulnerability affects a range of Siemens RUGGEDCOM and SCALANCE products due to improper validation of uploaded X509 certificates. Attackers who possess administrative privileges might exploit this flaw, allowing them to execute arbitrary code on the targeted devices. With various products identified, users are urged to review their system versions and apply necessary updates to mitigate potential risks associated with this vulnerability.

Affected Version(s)

RUGGEDCOM RM1224 LTE(4G) EU 0

RUGGEDCOM RM1224 LTE(4G) NAM 0

SCALANCE M804PB 0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-69938...
https://cert-portal.siemens.com/productcert/pdf/ssa-06804...
https://cert-portal.siemens.com/productcert/html/ssa-6993...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.