Siemens RUGGEDCOM ROX II Cross-Site Request Forgery (CVE-2020-28398)

The CLI feature in the web interface of affected devices is vulnerable to cross-site request forgery CSRF. This could allow an attacker to read or modify the device configuration by tricking an authenticated legitimate user into accessing a malicious link. This plugin only works with Tenable.ot...

Siemens RUGGEDCOM ROX II Cross-Site Request Forgery Vulnerability

RUGGEDCOM ROX II is a ROX-based VPN endpoint and firewall device for connecting devices operating in harsh environments, such as power substations and traffic control cabinets. A cross-site request forgery vulnerability exists in the Siemens RUGGEDCOM ROX II, which can be exploited by an attacker...

Siemens RUGGEDCOM 安全漏洞

RUGGEDCOM ROX II is a ROX-based VPN endpoint and firewall device for connecting devices operating in harsh environments, such as power substations and traffic control cabinets. A cross-site request forgery vulnerability exists in the Siemens RUGGEDCOM ROX II, which can be exploited by an attacker...

Siemens RUGGEDCOM ROX II 

SUMMARY The CLI feature in the web interface of RUGGEDCOM ROX II devices is vulnerable to cross-site request forgery CSRF, which could allow an attacker to perform administrative actions if an authenticated user is tricked into accessing a malicious link. Siemens has released new versions for...

Siemens Industrial Products Uncontrolled Resource Consumption (CVE-2019-11478)

Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. A remote attacker could cause a denial of service condition by sending specially crafted TCP Selective Acknowledgment SACK sequences to affected products. This plugin only works with Tenable.ot...

Siemens Industrial Products Uncontrolled Resource Consumption (CVE-2019-11479)

Multiple industrial products are affected by a vulnerability in the kernel known as TCP SACK PANIC. An attacker with network access to affected products could cause a denial of service condition because of a vulnerability in the TCP retransmission queue implementation kernel when handling TCP...

Siemens (CVE-2019-11745)

When encrypting with a block cipher, if a call to NSCEncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3, an...

Siemens RUGGEDCOM ROX II Improper Certificate Validation (CVE-2019-17007)

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens RUGGEDCOM ROX II

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: RUGGEDCOM ROX IIB Vulnerabilities: Improper Input Validation, NULL Pointer Dereference, Out-of-Bounds Write, Insufficient Verification of Data Authenticity, Improper Certificate...

ICSA-19-253-03_Siemens Industrial Products (Update P)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Industrial Products Vulnerabilities: Excessive Data Query Operations in a Large Data Table, Integer Overflow or Wraparound, Uncontrolled Resource Consumption 2. UPDATE INFORMATION...

ICSA-19-099-05 Siemens RUGGEDCOM ROX II

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: RUGGEDCOM ROX II Vulnerabilities: Double Free, Out-of-bounds Read, Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

CVE-2018-13802

A vulnerability has been identified in ROX II All versions V2.12.1. An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network...

CVE-2018-13802

A vulnerability has been identified in ROX II All versions V2.12.1. An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network...

CVE-2018-13801

A vulnerability has been identified in ROX II All versions V2.12.1. An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires user privileges of a...

CVE-2018-13801

A vulnerability has been identified in ROX II All versions V2.12.1. An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires user privileges of a...

Code injection

A vulnerability has been identified in ROX II All versions V2.12.1. An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network...

Privilege escalation

A vulnerability has been identified in ROX II All versions V2.12.1. An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires user privileges of a...

CVE-2018-13802

Siemens ROX II is affected by CVE-2018-13802. All ROX II versions prior to 2.12.1 are vulnerable to an elevation-of-privilege/command execution flaw accessible via SSH. An authenticated attacker with a high-privileged user account can log in over port 22, bypass restrictions, and execute arbitrar...

CVE-2018-13802

A vulnerability has been identified in ROX II All versions V2.12.1. An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network...

CVE-2018-13801

A vulnerability has been identified in ROX II All versions V2.12.1. An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires user privileges of a...