PT-2025-28403 · Siemens · Ruggedcom Rs900+17

Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-41224

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RMC8388 versions prior to V5.10.0 RUGGEDCOM RMC8388NC versions prior to V5.10.0 RUGGEDCOM RS416NCv2 versions prior to V5.10.0 RUGGEDCOM RS416PNCv2 versions prior to V5.10.0 RUGGEDCOM RS416Pv2 versions prior to V5.10.0 RUGGEDCOM RS416v2 versions prior to V5.10.0 RUGGEDCOM RS900 (32M) versions prior to V5.10.0 RUGGEDCOM RS900G (32M) versions prior to V5.10.0 RUGGEDCOM RS900GNC(32M) versions prior to V5.10.0 RUGGEDCOM RS900NC(32M) versions prior to V5.10.0 RUGGEDCOM RSG2100 (32M) versions prior to V5.10.0 RUGGEDCOM RSG2100NC(32M) versions prior to V5.10.0 RUGGEDCOM RSG2100P (32M) versions prior to V5.10.0 RUGGEDCOM RSG2100PNC (32M) versions prior to V5.10.0 RUGGEDCOM RSG2288 versions prior to V5.10.0 RUGGEDCOM RSG2288NC versions prior to V5.10.0 RUGGEDCOM RSG2300 versions prior to V5.10.0 RUGGEDCOM RSG2300NC versions prior to V5.10.0 RUGGEDCOM RSG2300P versions prior to V5.10.0 RUGGEDCOM RSG2300PNC versions prior to V5.10.0 RUGGEDCOM RSG2488 versions prior to V5.10.0 RUGGEDCOM RSG2488NC versions prior to V5.10.0 RUGGEDCOM RSG907R versions prior to V5.10.0 RUGGEDCOM RSG908C versions prior to V5.10.0 RUGGEDCOM RSG909R versions prior to V5.10.0 RUGGEDCOM RSG910C versions prior to V5.10.0 RUGGEDCOM RSG920P versions prior to V5.10.0 RUGGEDCOM RSG920PNC versions prior to V5.10.0 RUGGEDCOM RSL910 versions prior to V5.10.0 RUGGEDCOM RSL910NC versions prior to V5.10.0 RUGGEDCOM RST2228 versions prior to V5.10.0 RUGGEDCOM RST2228P versions prior to V5.10.0 RUGGEDCOM RST916C versions prior to V5.10.0 RUGGEDCOM RST916P versions prior to V5.10.0

Description: The affected products do not properly enforce interface access restrictions when changing from management to non-management interface configurations until a system reboot occurs, despite configuration being saved. This could allow an attacker with network access and credentials to gain access to the device through non-management and maintain SSH access to the device until reboot.

Recommendations: Update to version V5.10.0 or later for all affected RUGGEDCOM products to resolve the issue. As a temporary workaround, consider rebooting the system after changing interface configurations to ensure access restrictions are properly enforced. Restrict access to the device through non-management interfaces to minimize the risk of exploitation until the update can be applied.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BDU:2025-10422

CVE-2025-41224

Affected Products

Ruggedcom Rmc8388

Ruggedcom Rs416Pv2

Ruggedcom Rs900

Ruggedcom Rs900G

Ruggedcom Rsg2100

Ruggedcom Rsg2100P

Ruggedcom Rsg2288

Ruggedcom Rsg2300

Ruggedcom Rsg2300P

Ruggedcom Rsg2488

Ruggedcom Rsg907R

Ruggedcom Rsg908C

Ruggedcom Rsg909R

Ruggedcom Rsg910C

Ruggedcom Rsg920P

Ruggedcom Rsl910

Ruggedcom Rst2228

Ruggedcom Rst916C

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41224 · Security Note
• https://bdu.fstec.ru/vul/2025-10422 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-083019.html · Note
• https://twitter.com/CVEnew/status/1942535934836367619 · Twitter Post