PT-2024-5193 · Siemens · Ruggedcom Crossbow

Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-27943

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM CROSSBOW versions prior to V5.5

Description: The issue is related to incorrect external control of a file name or path in the Firmware Upload Handler component of the RUGGEDCOM CROSSBOW system. This could allow a remote attacker to upload arbitrary files and execute arbitrary code. A privileged user can upload generic files to the root installation directory, potentially allowing an attacker to tamper with specific files or achieve remote code execution.

Recommendations: For versions prior to V5.5, update to version V5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Firmware Upload Handler component to minimize the risk of exploitation. Additionally, restrict file uploads to authorized users and validate file types to prevent arbitrary file uploads.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-73

CWE-434

Related Identifiers

BDU:2024-05750

CVE-2024-27943

Affected Products

Ruggedcom Crossbow

References · 11

• https://cert-portal.siemens.com/productcert/html/ssa-916916.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27943 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27943 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-27943 · Security Note
• https://bdu.fstec.ru/vul/2024-05750 · Security Note
• https://cve.circl.lu/cve/CVE-2024-27943 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27943 · Note
• https://vuldb.com/?id.264139 · Note
• https://vulners.com/cve/CVE-2024-27943 · Note
• https://opencve.io/cve/CVE-2024-27943 · Note
• https://its.ny.gov/2024-055 · Note