Siemens RUGGEDCOM APE180

🗓️ 10 Oct 2023 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 60 Views

Siemens RUGGEDCOM APE1808 SQL Injection, Cross-site Scripting, Improper Input Validation, Incorrect Authorization, Session Fixation vulnerabilitie

Reporter	Title	Published	Views	Family All 78
BDU FSTEC	The vulnerability of the Reports component in the Nozomi Guardian network activity detection and tracking tool, as well as the Nozomi Central Management Console (CMC), allows a malicious actor to trigger a service failure.	2 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Threat Intelligence service of the Nozomi Guardian detection and monitoring network activity tool, as well as the Nozomi Central Management Console (CMC) – a centralized security management tool – allows attackers to carry out cross-site scenario attacks.	2 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Nozomi Guardian detection and tracking tool for network activities, as well as the Nozomi Central Management Console (CMC) – a central management tool for security operations – stems from the lack of protective measures for the SQL query structure. This allows attackers to gain unauthorized access to protected information and execute arbitrary SQL queries.	2 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SAML (Security Assertion Markup Language) technology used in the Nozomi Guardian network detection and monitoring tool, as well as the Nozomi Central Management Console (CMC) – a centralized security management tool – allows a malicious actor to trigger a service failure.	2 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-22378	9 Aug 202312:16	–	circl
Circl	CVE-2023-22843	9 Aug 202312:16	–	circl
Circl	CVE-2023-23574	9 Aug 202312:16	–	circl
Circl	CVE-2023-24471	14 Aug 202316:17	–	circl
Circl	CVE-2023-24477	9 Aug 202312:16	–	circl
CNNVD	Nozomi Networks Guardian/CMC SQL Injection Vulnerability	9 Aug 202300:00	–	cnnvd

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-647455.json
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-647455.html
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-647455.pdf
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-647455.txt
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-285-07.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-285-07
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

10 Oct 2023 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.8

CVSS 48.7

EPSS0.00508

SSVC