Security feature bypass

The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566...

CVE-2015-5537

Technical details about CVE-2015-5537 are not publicly provided in the supplied documents. No product/version/root-cause/impact/fix information is present here. Monitor for updates.

Siemens RuggedCom Improper Ethernet Frame Padding Vulnerability

OVERVIEW David Formby and Raheem Beyah of Georgia Tech have identified a vulnerability caused by an Institute of Electrical and Electronics Engineers IEEE conformance issue involving improper frame padding in Siemens RuggedCom ROS-based devices. Siemens has already released a revision that...

Siemens multiple products there is a security problem, the part of the patch has been released-vulnerability warning-the black bar safety net

Siemens recently released software and firmware security update, saying the company multiple products there are security issues, users are advised to update ASAP. ICS-CERT and Siemens announcement that the SIPROTEC 4 and SIPROTEC Compact devices recently have been affected by the vulnerability...

Siemens RUGGEDCOM ROS and ROX-based Devices TLS POODLE Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the advisory titled ICSA-15-202-03A Siemens RUGGEDCOM ROS and ROX Based Devices TLS POODLE Vulnerability that was published July 25, 2015, on the NCCIC/ICS-CERT web site. Siemens has reported to ICS-CERT that a Transport Layer Security TLS Padding...

Siemens ROS Improper Input Validation (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-14-087-01 Siemens ROS Improper Input Validation that was published March 28, 2014, on the NCCIC/ICS-CERT web site. Researcher Aivar Liimets from Martem Telecontrol Systems reported an improper input validation...

Siemens RuggedCom Uncontrolled Resource Consumption Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-051-03A Siemens RuggedCom Uncontrolled Resource Consumption Vulnerability that was published March 18, 2014, on the NCCIC/ICS-CERT web site. Researchers Ling Toh Koh, Ng Yi Teng, Seyed Dawood Sajjadi Torshizi, Ry...

CVE-2014-2590

The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service interface outage via crafted HTTP packets...

Design/Logic Flaw

The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service interface outage via crafted HTTP packets...

CVE-2014-2590

The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service interface outage via crafted HTTP packets...

CVE-2014-2590

CVE-2014-2590 concerns Siemens RuggedCom ROS web management interface. The vulnerability stems from improper input validation in the HTTP handling of the device’s web server, allowing remote attackers to cause a denial-of-service (interface outage) via specially crafted HTTP packets. Affected pro...

Siemens RuggedCom资源耗尽漏洞

CVECAN ID: CVE-2014-1966 RuggedCom ROS产品是交换机和串行到以太网设备。 RuggedCom ROS设备 3.11之前版本的SNMP实现中存在安全漏洞，远程攻击者通过特制的数据包利用此漏洞可造成拒绝服务。 0 Siemens RuggedCom ROS-based 3.11 厂商补丁： Siemens ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.siemens.com/corporate-technology/pool/...

CVE-2014-1966

The CVE-2014-1966 issue affects Siemens RuggedCom ROS: SNMP implementation in ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488. The vulnerability allows remote attackers to cause a denial of service (device outage) by sending specially crafted SNMP packets. Do...

CVE-2014-1966

The SNMP implementation in Siemens RuggedCom ROS before 3.11, ROS 3.11 for RS950G, ROS 3.12 before 3.12.4, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service device outage via crafted packets...

CVE-2013-6925

The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value...

CVE-2013-6925

CVE-2013-6925 affects Siemens RuggedCom ROS prior to version 3.12.2, where the integrated HTTPS Web server on Port 443 could allow remote attackers to hijack active Web sessions by predicting a session ID value. Root cause is use of insufficiently random values (CWE-330), enabling session predict...

CVE-2013-6925

The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id value...

CVE-2013-6926

The CVE concerns Siemens RuggedCom ROS prior to v3.12.2, where the integrated HTTPS server on port 443/TCP could allow remote authenticated attackers to bypass restrictions and perform limited administrative actions by using a guest or operator account. The vulnerability stems from an authenticat...

RuggedCom ROS Multiple Vulnerabilities

OVERVIEW Siemens has reported to NCCIC/ICS-CERT multiple vulnerabilities in the RuggedCom Rugged OS ROS. Siemens has produced a firmware update that mitigates these vulnerabilities. Exploitation of these vulnerabilities could allow an attacker to hijack an active Web session and access...

CVE-2012-4698

Siemens RuggedCom Rugged Operating System ROS before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication, which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network...