PT-2017-15473 · Siemens · Siemens Ruggedcom Rox I

Maxim Rupp · Published 2017-03-29 · Updated 2017-07-12 · CVE-2017-2686

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens RUGGEDCOM ROX I (all versions)

Description The issue allows an authenticated user to read arbitrary files through the web interface at port 10000/TCP, potentially accessing sensitive information.

Recommendations For all versions, restrict access to the web interface at port 10000/TCP to minimize the risk of exploitation. Consider implementing additional security measures to limit the ability of authenticated users to read arbitrary files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Information Disclosure

Weakness Enumeration

CWE-285

CWE-200

Related Identifiers

CVE-2017-2686

Affected Products

Siemens Ruggedcom Rox I

References · 6

• https://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2686 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2686 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-17-087-01 · Note
• http://securityfocus.com/bid/97170 · Note
• http://securitytracker.com/id/1038160 · Note