PT-2024-8752 · Siemens · Ruggedcom Crossbow

Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-27940

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V5.5

Description The issue is related to the lack of protection against SQL query structure manipulation. This allows a remote attacker to execute arbitrary SQL queries. The affected systems permit any authenticated user to send arbitrary SQL commands to the SQL server, which could be used to compromise the entire database.

Recommendations For versions prior to V5.5, update to version V5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL server to minimize the risk of exploitation. Avoid using the SQL server for sensitive operations until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-10356

CVE-2024-27940

Affected Products

Ruggedcom Crossbow

References · 5

• https://cert-portal.siemens.com/productcert/html/ssa-916916.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10356 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27940 · Security Note
• https://vuldb.com/?id.264161 · Note