PT-2023-4886 · Siemens · Ruggedcom Crossbow

Published 2023-08-08 · Updated 2023-08-10 · CVE-2023-37373

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.4

Description A vulnerability has been identified that allows unauthenticated remote attackers to write arbitrary files to the affected application's file system due to the lack of authentication for a critical function. This issue is related to the secure access control system of RUGGEDCOM CROSSBOW.

Recommendations For versions prior to V5.4, update to version V5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to critical functions that accept file write messages to prevent exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-05377

CVE-2023-37373

Affected Products

Ruggedcom Crossbow

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-37373 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37373 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-472630.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05377 · Security Note
• https://t.me/cibsecurity/67957 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023081011 · Note