PT-2024-4127 · Siemens · Ruggedcom Crossbow

Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-27939

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.5

Description The issue is related to weaknesses in the authorization procedure of the secure access management system. It allows an unauthenticated user to upload arbitrary files, which can be leveraged by an attacker to achieve arbitrary code execution with system privileges.

Recommendations For versions prior to V5.5, update to version V5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to file upload functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-04596

CVE-2024-27939

Affected Products

Ruggedcom Crossbow

References · 5

• https://cert-portal.siemens.com/productcert/html/ssa-916916.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27939 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27939 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04596 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024051720 · Note