PT-2023-1879 · Siemens · Ruggedcom Crossbow

Published 2023-03-14 · Updated 2023-03-17 · CVE-2023-27309

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.2

Description The issue is related to the client query handler of the secure access management system, which has inadequate authorization procedure. This could allow a remote attacker to perform unauthorized actions by exploiting the lack of proper permission checks for specific write queries.

Recommendations For versions prior to V5.2, update to version V5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the client query handler to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2023-01480

CVE-2023-27309

Affected Products

Ruggedcom Crossbow

References · 4

• https://bdu.fstec.ru/vul/2023-01480 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27309 · Security Note