MACSEC Key Leakage in RUGGEDCOM RST2228 and RST2228P by Siemens
CVE-2023-52238

2.3LOW

Key Information:

Vendor
Siemens
Status
Ruggedcom Rst2228
Ruggedcom Rst2228p
Vendor
CVE Published:
9 July 2024

Summary

A vulnerability exists in the web server of RUGGEDCOM RST2228 and RST2228P systems, allowing low privileged users to retrieve the MACSEC key in clear text. This security flaw enables unauthorized decryption of ethernet frames, compromising the confidentiality of sensitive data transmitted over the network. Users are advised to update to version V5.9.0 or later to mitigate the risk associated with this vulnerability.

Affected Version(s)

RUGGEDCOM RST2228 0

RUGGEDCOM RST2228P 0

References

https://cert-portal.siemens.com/productcert/html/ssa-1703...

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

.