CVE-2023-36752

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_mx5000re_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_mx5000re:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1524:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx1536:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND

cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*

History

18 Jul 2023, 18:36

Type	Values Removed	Values Added
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf -~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
CPE		cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:::::::* cpe:2.3:h:siemens:ruggedcom_rox_rx1536:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_mx5000re:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:::::::: cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:::::::: cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:::::::* cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_mx5000re_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1524:-:::::::* cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:::::::: cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:::::::*
CWE		CWE-77
First Time		Siemens ruggedcom Rox Rx1501 Firmware Siemens ruggedcom Rox Rx1500 Firmware Siemens ruggedcom Rox Mx5000 Siemens ruggedcom Rox Rx1400 Siemens ruggedcom Rox Rx1524 Siemens ruggedcom Rox Rx1400 Firmware Siemens Siemens ruggedcom Rox Rx5000 Firmware Siemens ruggedcom Rox Mx5000 Firmware Siemens ruggedcom Rox Rx1501 Siemens ruggedcom Rox Rx1510 Siemens ruggedcom Rox Rx1512 Firmware Siemens ruggedcom Rox Rx5000 Siemens ruggedcom Rox Rx1510 Firmware Siemens ruggedcom Rox Rx1511 Firmware Siemens ruggedcom Rox Rx1500 Siemens ruggedcom Rox Mx5000re Siemens ruggedcom Rox Rx1511 Siemens ruggedcom Rox Mx5000re Firmware Siemens ruggedcom Rox Rx1536 Firmware Siemens ruggedcom Rox Rx1524 Firmware Siemens ruggedcom Rox Rx1512 Siemens ruggedcom Rox Rx1536

11 Jul 2023, 12:43

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-11 10:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-36752

Mitre link : CVE-2023-36752

CVE.ORG link : CVE-2023-36752

JSON object : View

Products Affected

siemens

ruggedcom_rox_rx1400
ruggedcom_rox_mx5000_firmware
ruggedcom_rox_rx1511
ruggedcom_rox_mx5000re_firmware
ruggedcom_rox_mx5000
ruggedcom_rox_rx1501_firmware
ruggedcom_rox_rx1511_firmware
ruggedcom_rox_rx5000_firmware
ruggedcom_rox_rx1524_firmware
ruggedcom_rox_rx1512
ruggedcom_rox_rx1400_firmware
ruggedcom_rox_rx1536_firmware
ruggedcom_rox_mx5000re
ruggedcom_rox_rx1524
ruggedcom_rox_rx5000
ruggedcom_rox_rx1500_firmware
ruggedcom_rox_rx1501
ruggedcom_rox_rx1510
ruggedcom_rox_rx1512_firmware
ruggedcom_rox_rx1536
ruggedcom_rox_rx1500
ruggedcom_rox_rx1510_firmware

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

7.2 /10