PT-2017-15473 · Siemens · Siemens Ruggedcom Rox I

Maxim Rupp · Publicado 2017-03-29 · Atualizado 2017-07-12 · CVE-2017-2686

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens RUGGEDCOM ROX I (all versions)

Description The issue allows an authenticated user to read arbitrary files through the web interface at port 10000/TCP, potentially accessing sensitive information.

Recommendations For all versions, restrict access to the web interface at port 10000/TCP to minimize the risk of exploitation. Consider implementing additional security measures to limit the ability of authenticated users to read arbitrary files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Information Disclosure

Enumeração de Fraquezas

CWE-285

CWE-200

Identificadores relacionados

CVE-2017-2686

Produtos afetados

Siemens Ruggedcom Rox I

Referências · 6

• https://ics-cert.us-cert.gov/advisories/ICSA-17-087-01 · Nota
• https://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2686 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-2686 · Aviso do Fabricante
• http://securityfocus.com/bid/97170 · Nota
• http://securitytracker.com/id/1038160 · Nota