Input Sanitization Flaw in RUGGEDCOM and SCALANCE Devices by Siemens
CVE-2023-44373

9.4CRITICAL

Key Information:

Vendor

Siemens
Status
Ruggedcom Rm1224 Lte(4g) Eu
Ruggedcom Rm1224 Lte(4g) Nam
Scalance M804pb
Scalance M812-1 Adsl-router
Vendor
CVE Published:
14 November 2023

What is CVE-2023-44373?

The identified flaw in Siemens' RUGGEDCOM and SCALANCE devices involves inadequate sanitization of an input field. This vulnerability permits authenticated remote attackers with administrative access to execute arbitrary code or launch a system root shell, thereby compromising the integrity and security of the affected systems. Users are advised to update to the latest firmware versions to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

RUGGEDCOM RM1224 LTE(4G) EU 0

RUGGEDCOM RM1224 LTE(4G) NAM 0

SCALANCE M804PB 0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-69938...
https://cert-portal.siemens.com/productcert/pdf/ssa-18070...
https://cert-portal.siemens.com/productcert/html/ssa-6993...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.