Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2023-44317

Summary
Assigner-siemens
Assigner Org ID-cec7a2ec-15b4-4faf-bd53-b40f371f3a77
Published At-14 Nov, 2023 | 11:03
Updated At-14 Jan, 2025 | 10:28
Rejected At-
Credits

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.2.2), SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:siemens
Assigner Org ID:cec7a2ec-15b4-4faf-bd53-b40f371f3a77
Published At:14 Nov, 2023 | 11:03
Updated At:14 Jan, 2025 | 10:28
Rejected At:
▼CVE Numbering Authority (CNA)

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.2.2), SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.

Affected Products
Vendor
Siemens AGSiemens
Product
RUGGEDCOM RM1224 LTE(4G) EU
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
RUGGEDCOM RM1224 LTE(4G) NAM
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M804PB
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M812-1 ADSL-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M812-1 ADSL-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M816-1 ADSL-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M816-1 ADSL-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M826-2 SHDSL-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M874-2
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M874-3
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-3
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-3 (ROK)
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-4
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-4 (EU)
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-4 (NAM)
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM853-1 (EU)
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (EU)
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (RoW)
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE S615 EEC LAN-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE S615 LAN-Router
Default Status
unknown
Versions
Affected
  • From 0 before V7.2.2 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAB762-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM763-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM763-1 (ME)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM763-1 (US)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM766-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM766-1 (ME)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM766-1 (US)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM766-1 EEC
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM766-1 EEC (ME)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WAM766-1 EEC (US)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUB762-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUB762-1 iFeatures
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM763-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM763-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM763-1 (US)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM763-1 (US)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM766-1
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM766-1 (ME)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE WUM766-1 (USA)
Default Status
unknown
Versions
Affected
  • From 0 before V3.0.0 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-349CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
Type: CWE
CWE ID: CWE-349
Description: CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
Metrics
VersionBase scoreBase severityVector
3.17.2HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
4.08.6HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 7.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Version: 4.0
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
N/A
https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
N/A
https://cert-portal.siemens.com/productcert/html/ssa-699386.html
N/A
https://cert-portal.siemens.com/productcert/html/ssa-068047.html
N/A
https://cert-portal.siemens.com/productcert/html/ssa-602936.html
N/A
https://cert-portal.siemens.com/productcert/html/ssa-690517.html
N/A
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-699386.html
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-068047.html
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-602936.html
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
x_transferred
https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-699386.html
x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-068047.html
x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-602936.html
x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-690517.html
x_transferred
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
Resource:
x_transferred
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
Resource:
x_transferred
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-699386.html
Resource:
x_transferred
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-068047.html
Resource:
x_transferred
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-602936.html
Resource:
x_transferred
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:productcert@siemens.com
Published At:14 Nov, 2023 | 11:15
Updated At:14 Jan, 2025 | 11:15

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.2.2), SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.08.6HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Secondary3.17.2HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 4.0
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 3.1
Base score: 7.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE Matches
Siemens AG
siemens
>>scalance_xb208_\(e\/ip\)_firmware>>-
cpe:2.3:o:siemens:scalance_xb208_\(e\/ip\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb208_\(e\/ip\)>>-
cpe:2.3:h:siemens:scalance_xb208_\(e\/ip\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb208_\(pn\)_firmware>>-
cpe:2.3:o:siemens:scalance_xb208_\(pn\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb208_\(pn\)>>-
cpe:2.3:h:siemens:scalance_xb208_\(pn\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb216_\(e\/ip\)_firmware>>-
cpe:2.3:o:siemens:scalance_xb216_\(e\/ip\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb216_\(e\/ip\)>>-
cpe:2.3:h:siemens:scalance_xb216_\(e\/ip\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb216_\(pn\)_firmware>>-
cpe:2.3:o:siemens:scalance_xb216_\(pn\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xb216_\(pn\)>>-
cpe:2.3:h:siemens:scalance_xb216_\(pn\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2_\(sc\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2_\(sc\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2_\(sc\)>>-
cpe:2.3:h:siemens:scalance_xc206-2_\(sc\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2_\(st\/bfoc\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2_\(st\/bfoc\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2_\(st\/bfoc\)>>-
cpe:2.3:h:siemens:scalance_xc206-2_\(st\/bfoc\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2g_poe_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2g_poe_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2g_poe>>-
cpe:2.3:h:siemens:scalance_xc206-2g_poe:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2g_poe_\(54_v_dc\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2g_poe_\(54_v_dc\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2g_poe_\(54_v_dc\)>>-
cpe:2.3:h:siemens:scalance_xc206-2g_poe_\(54_v_dc\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2g_poe_eec_\(54_v_dc\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2g_poe_eec_\(54_v_dc\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2g_poe_eec_\(54_v_dc\)>>-
cpe:2.3:h:siemens:scalance_xc206-2g_poe_eec_\(54_v_dc\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2sfp_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp>>-
cpe:2.3:h:siemens:scalance_xc206-2sfp:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_eec_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2sfp_eec_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_eec>>-
cpe:2.3:h:siemens:scalance_xc206-2sfp_eec:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_g_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2sfp_g_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_g>>-
cpe:2.3:h:siemens:scalance_xc206-2sfp_g:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_g_\(eip_def.\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2sfp_g_\(eip_def.\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_g_\(eip_def.\)>>-
cpe:2.3:h:siemens:scalance_xc206-2sfp_g_\(eip_def.\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_g_eec_firmware>>-
cpe:2.3:o:siemens:scalance_xc206-2sfp_g_eec_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc206-2sfp_g_eec>>-
cpe:2.3:h:siemens:scalance_xc206-2sfp_g_eec:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208_firmware>>-
cpe:2.3:o:siemens:scalance_xc208_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208>>-
cpe:2.3:h:siemens:scalance_xc208:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208eec_firmware>>-
cpe:2.3:o:siemens:scalance_xc208eec_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208eec>>-
cpe:2.3:h:siemens:scalance_xc208eec:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_firmware>>-
cpe:2.3:o:siemens:scalance_xc208g_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g>>-
cpe:2.3:h:siemens:scalance_xc208g:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_\(eip_def.\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc208g_\(eip_def.\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_\(eip_def.\)>>-
cpe:2.3:h:siemens:scalance_xc208g_\(eip_def.\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_eec_firmware>>-
cpe:2.3:o:siemens:scalance_xc208g_eec_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_eec>>-
cpe:2.3:h:siemens:scalance_xc208g_eec:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_poe_firmware>>-
cpe:2.3:o:siemens:scalance_xc208g_poe_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_poe>>-
cpe:2.3:h:siemens:scalance_xc208g_poe:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_poe_\(54_v_dc\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc208g_poe_\(54_v_dc\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc208g_poe_\(54_v_dc\)>>-
cpe:2.3:h:siemens:scalance_xc208g_poe_\(54_v_dc\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216_firmware>>-
cpe:2.3:o:siemens:scalance_xc216_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216>>-
cpe:2.3:h:siemens:scalance_xc216:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216-3g_poe_firmware>>-
cpe:2.3:o:siemens:scalance_xc216-3g_poe_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216-3g_poe>>-
cpe:2.3:h:siemens:scalance_xc216-3g_poe:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216-3g_poe_\(54_v_dc\)_firmware>>-
cpe:2.3:o:siemens:scalance_xc216-3g_poe_\(54_v_dc\)_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216-3g_poe_\(54_v_dc\)>>-
cpe:2.3:h:siemens:scalance_xc216-3g_poe_\(54_v_dc\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216-4c_firmware>>-
cpe:2.3:o:siemens:scalance_xc216-4c_firmware:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_xc216-4c>>-
cpe:2.3:h:siemens:scalance_xc216-4c:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-349Secondaryproductcert@siemens.com
CWE ID: CWE-349
Type: Secondary
Source: productcert@siemens.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://cert-portal.siemens.com/productcert/html/ssa-068047.htmlproductcert@siemens.com
N/A
https://cert-portal.siemens.com/productcert/html/ssa-602936.htmlproductcert@siemens.com
N/A
https://cert-portal.siemens.com/productcert/html/ssa-690517.htmlproductcert@siemens.com
N/A
https://cert-portal.siemens.com/productcert/html/ssa-699386.htmlproductcert@siemens.com
N/A
https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdfproductcert@siemens.com
N/A
https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdfproductcert@siemens.com
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-068047.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://cert-portal.siemens.com/productcert/html/ssa-602936.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://cert-portal.siemens.com/productcert/html/ssa-690517.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://cert-portal.siemens.com/productcert/html/ssa-699386.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdfaf854a3a-2127-422b-91ae-364da2661108
N/A
https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdfaf854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-068047.html
Source: productcert@siemens.com
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-602936.html
Source: productcert@siemens.com
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Source: productcert@siemens.com
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-699386.html
Source: productcert@siemens.com
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
Source: productcert@siemens.com
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
Source: productcert@siemens.com
Resource:
Vendor Advisory
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-068047.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-602936.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-690517.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-699386.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

72Records found
CVE-2021-37722
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-4.74% / 89.65%
||
7 Day CHG~0.00%
Published-07 Sep, 2021 | 12:09
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-arubaossd-wanscalance_w1750d_firmwarescalance_w1750dAruba SD-WAN Software and Gateways; Aruba Operating System Software
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-33733
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.76% / 73.68%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 09:49
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Action-Not Available
Vendor-Siemens AG
Product-sinec_nmsSINEC NMS
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-37721
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-4.74% / 89.65%
||
7 Day CHG~0.00%
Published-07 Sep, 2021 | 12:35
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-arubaossd-wanscalance_w1750d_firmwarescalance_w1750dAruba SD-WAN Software and Gateways; Aruba Operating System Software
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-33734
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.76% / 73.68%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 09:49
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Action-Not Available
Vendor-Siemens AG
Product-sinec_nmsSINEC NMS
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-37730
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-3.40% / 87.69%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 14:07
Updated-04 Aug, 2024 | 01:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-aruba_instantscalance_w1750d_firmwarescalance_w1750dHPE Aruba Instant (IAP)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-33732
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.76% / 73.68%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 09:49
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Action-Not Available
Vendor-Siemens AG
Product-sinec_nmsSINEC NMS
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-33731
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.76% / 73.68%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 09:49
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Action-Not Available
Vendor-Siemens AG
Product-sinec_nmsSINEC NMS
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-37718
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-4.74% / 89.65%
||
7 Day CHG~0.00%
Published-07 Sep, 2021 | 12:32
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-arubaossd-wanscalance_w1750d_firmwarescalance_w1750dAruba SD-WAN Software and Gateways; Aruba Operating System Software
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-37732
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-3.40% / 87.69%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 15:12
Updated-04 Aug, 2024 | 01:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant 8.7.x.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-aruba_instantscalance_w1750d_firmwarescalance_w1750dHPE Aruba Instant (IAP)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-37720
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-4.74% / 89.65%
||
7 Day CHG~0.00%
Published-07 Sep, 2021 | 12:08
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-arubaossd-wanscalance_w1750d_firmwarescalance_w1750dAruba SD-WAN Software and Gateways; Aruba Operating System Software
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-37717
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-4.74% / 89.65%
||
7 Day CHG~0.00%
Published-07 Sep, 2021 | 12:05
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-arubaossd-wanscalance_w1750d_firmwarescalance_w1750dAruba SD-WAN Software and Gateways; Aruba Operating System Software
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-37723
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-4.63% / 89.51%
||
7 Day CHG~0.00%
Published-07 Sep, 2021 | 12:10
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-arubaosscalance_w1750d_firmwarescalance_w1750dAruba Operating System Software
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-37727
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
ShareView Details
Matching Score-8
Assigner-Hewlett Packard Enterprise (HPE)
CVSS Score-7.2||HIGH
EPSS-3.40% / 87.69%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 14:08
Updated-04 Aug, 2024 | 01:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.

Action-Not Available
Vendor-n/aSiemens AGAruba Networks
Product-aruba_instantscalance_w1750d_firmwarescalance_w1750dHPE Aruba Instant (IAP)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2021-33735
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.64% / 71.11%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 09:49
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Action-Not Available
Vendor-Siemens AG
Product-sinec_nmsSINEC NMS
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-33730
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.76% / 73.68%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 09:49
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Action-Not Available
Vendor-Siemens AG
Product-sinec_nmsSINEC NMS
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-39569
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.5||HIGH
EPSS-2.45% / 85.52%
||
7 Day CHG~0.00%
Published-09 Jul, 2024 | 12:05
Updated-27 Aug, 2025 | 20:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1). The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an administrative remote attacker running a corresponding SINEMA Remote Connect Server to execute arbitrary code with system privileges on the client system.

Action-Not Available
Vendor-Siemens AG
Product-sinema_remote_connect_clientSINEMA Remote Connect Clientsinema_remote_connect_client
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-49691
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.12% / 30.34%
||
7 Day CHG~0.00%
Published-12 Dec, 2023 | 11:27
Updated-13 Aug, 2024 | 07:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.0). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the handling of the DDNS configuration. This could allow malicious local administrators to issue commands on system level after a successful IP address update.

Action-Not Available
Vendor-Siemens AG
Product-6gk5876-4aa10-2ba26gk5876-4aa00-2da2_firmware6gk5812-1ba00-2aa26gk5856-2ea00-3aa16gk6108-4am00-2da26gk5876-4aa00-2da26gk5876-3aa02-2ba2_firmware6gk5816-1aa00-2aa2_firmware6gk5876-3aa02-2ea2_firmware6gk5876-4aa00-2ba26gk5826-2ab00-2ab26gk5856-2ea00-3aa1_firmware6gk5876-4aa00-2ba2_firmware6gk5812-1aa00-2aa26gk6108-4am00-2da2_firmware6gk5856-2ea00-3da1_firmware6gk5874-2aa00-2aa2_firmware6gk5804-0ap00-2aa2_firmware6gk5874-3aa00-2aa26gk5812-1aa00-2aa2_firmware6gk5816-1ba00-2aa26gk5874-2aa00-2aa26gk5826-2ab00-2ab2_firmware6gk6108-4am00-2ba26gk5615-0aa00-2aa26gk5856-2ea00-3da16gk5816-1ba00-2aa2_firmware6gk5874-3aa00-2aa2_firmware6gk5853-2ea00-2da16gk5804-0ap00-2aa26gk5615-0aa01-2aa2_firmware6gk5876-3aa02-2ea26gk5876-4aa10-2ba2_firmware6gk5876-3aa02-2ba26gk6108-4am00-2ba2_firmware6gk5853-2ea00-2da1_firmware6gk5812-1ba00-2aa2_firmware6gk5615-0aa00-2aa2_firmware6gk5816-1aa00-2aa26gk5615-0aa01-2aa2SCALANCE M874-3SCALANCE M816-1 ADSL-RouterSCALANCE M876-3 (ROK)SCALANCE M812-1 ADSL-RouterSCALANCE M804PBSCALANCE MUM856-1 (EU)SCALANCE MUM853-1 (EU)SCALANCE S615 EEC LAN-RouterSCALANCE M874-2SCALANCE M876-4RUGGEDCOM RM1224 LTE(4G) NAMSCALANCE M876-3SCALANCE M826-2 SHDSL-RouterSCALANCE MUM856-1 (RoW)RUGGEDCOM RM1224 LTE(4G) EUSCALANCE M876-4 (EU)SCALANCE M876-4 (NAM)SCALANCE S615 LAN-Router
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-36752
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-1.74% / 82.92%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-20 Nov, 2024 | 20:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512ruggedcom_rox_mx5000reruggedcom_rox_rx1400ruggedcom_rox_rx5000ruggedcom_rox_rx1500ruggedcom_rox_rx1501ruggedcom_rox_rx1511ruggedcom_rox_rx1512ruggedcom_rox_rx1510ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-36755
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-1.11% / 78.55%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-19 Nov, 2024 | 16:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The SCEP CA Certificate Name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1400ruggedcom_rox_rx1500ruggedcom_rox_rx5000ruggedcom_rox_rx1512ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-36753
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-9.1||CRITICAL
EPSS-1.74% / 82.92%
||
7 Day CHG~0.00%
Published-11 Jul, 2023 | 09:07
Updated-02 Dec, 2024 | 18:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The uninstall-app App-name parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rox_mx5000reruggedcom_rox_rx1511ruggedcom_rox_rx1512_firmwareruggedcom_rox_rx1512ruggedcom_rox_mx5000_firmwareruggedcom_rox_rx1511_firmwareruggedcom_rox_rx1510ruggedcom_rox_rx1400_firmwareruggedcom_rox_rx1500_firmwareruggedcom_rox_rx1400ruggedcom_rox_rx1510_firmwareruggedcom_rox_rx1500ruggedcom_rox_rx1524_firmwareruggedcom_rox_rx5000ruggedcom_rox_rx1501ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1524ruggedcom_rox_rx1536_firmwareruggedcom_rox_mx5000re_firmwareruggedcom_rox_rx1501_firmwareruggedcom_rox_rx5000_firmwareRUGGEDCOM ROX MX5000RERUGGEDCOM ROX RX1511RUGGEDCOM ROX RX1536RUGGEDCOM ROX RX1400RUGGEDCOM ROX RX1501RUGGEDCOM ROX RX1500RUGGEDCOM ROX RX5000RUGGEDCOM ROX MX5000RUGGEDCOM ROX RX1524RUGGEDCOM ROX RX1510RUGGEDCOM ROX RX1512ruggedcom_rox_mx5000reruggedcom_rox_rx1524ruggedcom_rox_rx1400ruggedcom_rox_rx1501ruggedcom_rox_rx1500ruggedcom_rox_rx1511ruggedcom_rox_rx5000ruggedcom_rox_rx1512ruggedcom_rox_rx1536ruggedcom_rox_mx5000ruggedcom_rox_rx1510
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2023-28832
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-1.05% / 77.91%
||
7 Day CHG~0.00%
Published-09 May, 2023 | 11:51
Updated-28 Jan, 2025 | 18:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susceptible to command injection. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Action-Not Available
Vendor-Siemens AG
Product-6gk1411-1ac00_firmware6gk1411-5ac00_firmware6gk1411-1ac006gk1411-5ac00SIMATIC Cloud Connect 7 CC716SIMATIC Cloud Connect 7 CC712
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-41924
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-7.2||HIGH
EPSS-0.14% / 34.56%
||
7 Day CHG~0.00%
Published-30 Jul, 2024 | 08:45
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.

Action-Not Available
Vendor-EC-CUBE CO.,LTD.ec-cube
Product-EC-CUBE 4 seriesec-cube
CWE ID-CWE-349
Acceptance of Extraneous Untrusted Data With Trusted Data
  • Previous
  • 1
  • 2
  • Next
Details not found