PT-2022-10644 · Siemens · Ruggedcom Rsg909R+48

Published 2022-03-08 · Updated 2023-11-14 · CVE-2021-37209

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions RUGGEDCOM i800 versions prior to V4.3.8 RUGGEDCOM i801 versions prior to V4.3.8 RUGGEDCOM i802 versions prior to V4.3.8 RUGGEDCOM i803 versions prior to V4.3.8 RUGGEDCOM M2100 versions prior to V4.3.8 RUGGEDCOM M2200 versions prior to V4.3.8 RUGGEDCOM M969 versions prior to V4.3.8 RUGGEDCOM RMC30 versions prior to V4.3.8 RUGGEDCOM RMC8388 V4.X versions prior to V4.3.8 RUGGEDCOM RMC8388 V5.X versions prior to V5.7.0 RUGGEDCOM RP110 versions prior to V4.3.8 RUGGEDCOM RS1600 versions prior to V4.3.8 RUGGEDCOM RS1600F versions prior to V4.3.8 RUGGEDCOM RS1600T versions prior to V4.3.8 RUGGEDCOM RS400 versions prior to V4.3.8 RUGGEDCOM RS401 versions prior to V4.3.8 RUGGEDCOM RS416 versions prior to V4.3.8 RUGGEDCOM RS416Pv2 V4.X versions prior to V4.3.8 RUGGEDCOM RS416Pv2 V5.X versions prior to V5.7.0 RUGGEDCOM RS416v2 V4.X versions prior to V4.3.8 RUGGEDCOM RS416v2 V5.X versions prior to V5.7.0 RUGGEDCOM RS8000 versions prior to V4.3.8 RUGGEDCOM RS8000A versions prior to V4.3.8 RUGGEDCOM RS8000H versions prior to V4.3.8 RUGGEDCOM RS8000T versions prior to V4.3.8 RUGGEDCOM RS900 versions prior to V4.3.8 RUGGEDCOM RS900 (32M) V4.X versions prior to V4.3.8 RUGGEDCOM RS900 (32M) V5.X versions prior to V5.7.0 RUGGEDCOM RS900G versions prior to V4.3.8 RUGGEDCOM RS900G (32M) V4.X versions prior to V4.3.8 RUGGEDCOM RS900G (32M) V5.X versions prior to V5.7.0 RUGGEDCOM RS900GP versions prior to V4.3.8 RUGGEDCOM RS900L versions prior to V4.3.8 RUGGEDCOM RS900M-GETS-C01 versions prior to V4.3.8 RUGGEDCOM RS900M-GETS-XX versions prior to V4.3.8 RUGGEDCOM RS900M-STND-C01 versions prior to V4.3.8 RUGGEDCOM RS900M-STND-XX versions prior to V4.3.8 RUGGEDCOM RS900W versions prior to V4.3.8 RUGGEDCOM RS910 versions prior to V4.3.8 RUGGEDCOM RS910L versions prior to V4.3.8 RUGGEDCOM RS910W versions prior to V4.3.8 RUGGEDCOM RS920L versions prior to V4.3.8 RUGGEDCOM RS920W versions prior to V4.3.8 RUGGEDCOM RS930L versions prior to V4.3.8 RUGGEDCOM RS930W versions prior to V4.3.8 RUGGEDCOM RS940G versions prior to V4.3.8 RUGGEDCOM RS969 versions prior to V4.3.8 RUGGEDCOM RSG2100 versions prior to V4.3.8 RUGGEDCOM RSG2100 (32M) V4.X versions prior to V4.3.8 RUGGEDCOM RSG2100 (32M) V5.X versions prior to V5.7.0 RUGGEDCOM RSG2100P versions prior to V4.3.8 RUGGEDCOM RSG2200 versions prior to V4.3.8 RUGGEDCOM RSG2288 V4.X versions prior to V4.3.8 RUGGEDCOM RSG2288 V5.X versions prior to V5.7.0 RUGGEDCOM RSG2300 V4.X versions prior to V4.3.8 RUGGEDCOM RSG2300 V5.X versions prior to V5.7.0 RUGGEDCOM RSG2300P V4.X versions prior to V4.3.8 RUGGEDCOM RSG2300P V5.X versions prior to V5.7.0 RUGGEDCOM RSG2488 V4.X versions prior to V4.3.8 RUGGEDCOM RSG2488 V5.X versions prior to V5.7.0 RUGGEDCOM RSG907R versions prior to V5.7.0 RUGGEDCOM RSG908C versions prior to V5.7.0 RUGGEDCOM RSG909R versions prior to V5.7.0 RUGGEDCOM RSG910C versions prior to V5.7.0 RUGGEDCOM RSG920P V4.X versions prior to V4.3.8 RUGGEDCOM RSG920P V5.X versions prior to V5.7.0 RUGGEDCOM RSL910 versions prior to V5.7.0 RUGGEDCOM RST2228 versions prior to V5.7.0 RUGGEDCOM RST2228P versions prior to V5.7.0 RUGGEDCOM RST916C versions prior to V5.7.0 RUGGEDCOM RST916P versions prior to V5.7.0

Description The SSH server on affected devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device.

Recommendations For RUGGEDCOM i800 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM i801 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM i802 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM i803 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM M2100 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM M2200 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM M969 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RMC30 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RMC8388 V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RMC8388 V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RP110 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS1600 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS1600F versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS1600T versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS400 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS401 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS416 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS416Pv2 V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS416Pv2 V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RS416v2 V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS416v2 V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RS8000 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS8000A versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS8000H versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS8000T versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900 (32M) V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900 (32M) V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RS900G versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900G (32M) V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900G (32M) V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RS900GP versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900L versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900M-GETS-C01 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900M-GETS-XX versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900M-STND-C01 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900M-STND-XX versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS900W versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS910 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS910L versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS910W versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS920L versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS920W versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS930L versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS930W versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS940G versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RS969 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2100 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2100 (32M) V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2100 (32M) V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG2100P versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2200 versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2288 V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2288 V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG2300 V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2300 V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG2300P V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2300P V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG2488 V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG2488 V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG907R versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG908C versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG909R versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG910C versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSG920P V4.X versions prior to V4.3.8, update to version V4.3.8 or later. For RUGGEDCOM RSG920P V5.X versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RSL910 versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RST2228 versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RST2228P versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RST916C versions prior to V5.7.0, update to version V5.7.0 or later. For RUGGEDCOM RST916P versions prior to V5.7.0, update to version V5.7.0 or later.

Fix

Inadequate Encryption Strength

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-326

CWE-311

Related Identifiers

CVE-2021-37209

Affected Products

Ruggedcom M2100

Ruggedcom M2200

Ruggedcom M969

Ruggedcom Rmc30

Ruggedcom Rmc8388

Ruggedcom Rp110

Ruggedcom Rs1600

Ruggedcom Rs1600F

Ruggedcom Rs1600T

Ruggedcom Rs400

Ruggedcom Rs401

Ruggedcom Rs416

Ruggedcom Rs416Pv2

Ruggedcom Rs8000

Ruggedcom Rs8000A

Ruggedcom Rs8000H

Ruggedcom Rs8000T

Ruggedcom Rs900

Ruggedcom Rs900G

Ruggedcom Rs900Gp

Ruggedcom Rs900L

Ruggedcom Rs900M-Gets-C01

Ruggedcom Rs900M-Gets-Xx

Ruggedcom Rs900M-Stnd-C01

Ruggedcom Rs900M-Stnd-Xx

Ruggedcom Rsl910

Ruggedcom Rs910L

Ruggedcom Rs920L

Ruggedcom Rs930L

Ruggedcom Rs940G

Ruggedcom Rs969

Ruggedcom Rsg2100

Ruggedcom Rsg2100P

Ruggedcom Rsg2200

Ruggedcom Rsg2288

Ruggedcom Rsg2300

Ruggedcom Rsg2300P

Ruggedcom Rsg2488

Ruggedcom Rsg907R

Ruggedcom Rsg908C

Ruggedcom Rsg909R

Ruggedcom Rsg910C

Ruggedcom Rsg920P

Ruggedcom Rst2228

Ruggedcom Rst916C

Ruggedcom I800

Ruggedcom I801

Ruggedcom I802

Ruggedcom I803

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-764417.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37209 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-764417.html · Note
• https://t.me/cvenotify/37257 · Telegram Post