PT-2024-3687 · Siemens · Ruggedcom Crossbow

Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-27945

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.5

Description The issue is related to incorrect external control of a file name or path in the Firmware Upload Handler component of the RUGGEDCOM CROSSBOW system. This could allow a remote attacker to upload arbitrary files and execute arbitrary code. A privileged user can exploit the bulk import feature to upload files to the system's root installation directory, potentially tampering with specific files or achieving remote code execution.

Recommendations For versions prior to V5.5, update to version V5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the bulk import feature and the Firmware Upload Handler component to minimize the risk of exploitation. Avoid using the bulk import feature until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-73

CWE-434

Related Identifiers

BDU:2024-04031

CVE-2024-27945

Affected Products

Ruggedcom Crossbow

References · 7

• https://cert-portal.siemens.com/productcert/html/ssa-916916.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27945 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27945 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04031 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024051720 · Note
• https://github.com/advisories/GHSA-928h-v43x-jjq6 · Note
• https://vuldb.com/?id.264142 · Note