Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-41977

Summary
Assigner-siemens
Assigner Org ID-cec7a2ec-15b4-4faf-bd53-b40f371f3a77
Published At-13 Aug, 2024 | 07:54
Updated At-13 Aug, 2024 | 16:01
Rejected At-
Credits

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:siemens
Assigner Org ID:cec7a2ec-15b4-4faf-bd53-b40f371f3a77
Published At:13 Aug, 2024 | 07:54
Updated At:13 Aug, 2024 | 16:01
Rejected At:
â–¼CVE Numbering Authority (CNA)

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices.

Affected Products
Vendor
Siemens AGSiemens
Product
RUGGEDCOM RM1224 LTE(4G) EU
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
RUGGEDCOM RM1224 LTE(4G) NAM
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M804PB
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M812-1 ADSL-Router family
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M816-1 ADSL-Router family
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M826-2 SHDSL-Router
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M874-2
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M874-3
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M874-3 3G-Router (CN)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-3
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-3 (ROK)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-4
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-4 (EU)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE M876-4 (NAM)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM853-1 (A1)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM853-1 (B1)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM853-1 (EU)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (A1)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (B1)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (CN)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (EU)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE MUM856-1 (RoW)
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE S615 EEC LAN-Router
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Vendor
Siemens AGSiemens
Product
SCALANCE S615 LAN-Router
Default Status
unknown
Versions
Affected
  • From 0 before V8.1 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-488CWE-488: Exposure of Data Element to Wrong Session
Type: CWE
CWE ID: CWE-488
Description: CWE-488: Exposure of Data Element to Wrong Session
Metrics
VersionBase scoreBase severityVector
3.17.1HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
4.07.3HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Version: 4.0
Base score: 7.3
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://cert-portal.siemens.com/productcert/html/ssa-087301.html
N/A
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-087301.html
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
Siemens AGsiemens
Product
ruggedcom_rcm1224_firmware
CPEs
  • cpe:2.3:o:siemens:ruggedcom_rcm1224_firmware:6.2:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 6.2 before v8.1 (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:productcert@siemens.com
Published At:13 Aug, 2024 | 08:15
Updated At:23 Aug, 2024 | 18:39

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.07.3HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.18.0HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Secondary3.17.1HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 4.0
Base score: 7.3
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 8.0
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CPE Matches
Siemens AG
siemens
>>ruggedcom_rm1224_lte\(4g\)_eu_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:ruggedcom_rm1224_lte\(4g\)_eu_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>ruggedcom_rm1224_lte\(4g\)_eu>>-
cpe:2.3:h:siemens:ruggedcom_rm1224_lte\(4g\)_eu:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>ruggedcom_rm1224_lte\(4g\)_nam_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:ruggedcom_rm1224_lte\(4g\)_nam_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>ruggedcom_rm1224_lte\(4g\)_nam>>-
cpe:2.3:h:siemens:ruggedcom_rm1224_lte\(4g\)_nam:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m804pb_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m804pb_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m804pb>>-
cpe:2.3:h:siemens:scalance_m804pb:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m826-2_shdsl-router_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m826-2_shdsl-router_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m826-2_shdsl-router>>-
cpe:2.3:h:siemens:scalance_m826-2_shdsl-router:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m874-2_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m874-2_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m874-2>>-
cpe:2.3:h:siemens:scalance_m874-2:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m874-3_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m874-3_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m874-3>>-
cpe:2.3:h:siemens:scalance_m874-3:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-3_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m876-3_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-3>>-
cpe:2.3:h:siemens:scalance_m876-3:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-4_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m876-4_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-4>>-
cpe:2.3:h:siemens:scalance_m876-4:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m874-3_3g-router_\(cn\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m874-3_3g-router_\(cn\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m874-3_3g-router_\(cn\)>>-
cpe:2.3:h:siemens:scalance_m874-3_3g-router_\(cn\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-3_\(rok\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m876-3_\(rok\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-3_\(rok\)>>-
cpe:2.3:h:siemens:scalance_m876-3_\(rok\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-4_\(eu\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m876-4_\(eu\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-4_\(eu\)>>-
cpe:2.3:h:siemens:scalance_m876-4_\(eu\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-4_\(nam\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m876-4_\(nam\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m876-4_\(nam\)>>-
cpe:2.3:h:siemens:scalance_m876-4_\(nam\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum853-1_\(a1\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum853-1_\(a1\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum853-1_\(a1\)>>-
cpe:2.3:h:siemens:scalance_mum853-1_\(a1\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum853-1_\(b1\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum853-1_\(b1\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum853-1_\(b1\)>>-
cpe:2.3:h:siemens:scalance_mum853-1_\(b1\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum853-1_\(eu\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum853-1_\(eu\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum853-1_\(eu\)>>-
cpe:2.3:h:siemens:scalance_mum853-1_\(eu\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(a1\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum856-1_\(a1\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(a1\)>>-
cpe:2.3:h:siemens:scalance_mum856-1_\(a1\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(b1\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum856-1_\(b1\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(b1\)>>-
cpe:2.3:h:siemens:scalance_mum856-1_\(b1\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(cn\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum856-1_\(cn\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(cn\)>>-
cpe:2.3:h:siemens:scalance_mum856-1_\(cn\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(eu\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum856-1_\(eu\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(eu\)>>-
cpe:2.3:h:siemens:scalance_mum856-1_\(eu\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(row\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_mum856-1_\(row\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_mum856-1_\(row\)>>-
cpe:2.3:h:siemens:scalance_mum856-1_\(row\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_s615_eec_lan-router_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_s615_eec_lan-router_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_s615_eec_lan-router>>-
cpe:2.3:h:siemens:scalance_s615_eec_lan-router:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_s615_lan-router_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_s615_lan-router_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_s615_lan-router>>-
cpe:2.3:h:siemens:scalance_s615_lan-router:-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m812-1_\(annex_a\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m812-1_\(annex_a\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m812-1_\(annex_a\)>>-
cpe:2.3:h:siemens:scalance_m812-1_\(annex_a\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m812-1_\(annex_b\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m812-1_\(annex_b\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m812-1_\(annex_b\)>>-
cpe:2.3:h:siemens:scalance_m812-1_\(annex_b\):-:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m816-1_\(annex_a\)_firmware>>Versions before 8.1(exclusive)
cpe:2.3:o:siemens:scalance_m816-1_\(annex_a\)_firmware:*:*:*:*:*:*:*:*
Siemens AG
siemens
>>scalance_m816-1_\(annex_a\)>>-
cpe:2.3:h:siemens:scalance_m816-1_\(annex_a\):-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
NVD-CWE-OtherPrimarynvd@nist.gov
CWE-488Secondaryproductcert@siemens.com
CWE ID: NVD-CWE-Other
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-488
Type: Secondary
Source: productcert@siemens.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://cert-portal.siemens.com/productcert/html/ssa-087301.htmlproductcert@siemens.com
Vendor Advisory
Hyperlink: https://cert-portal.siemens.com/productcert/html/ssa-087301.html
Source: productcert@siemens.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

4Records found
CVE-2026-25789
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-7.2||HIGH
EPSS-0.27% / 19.46%
||
7 Day CHG~0.00%
Published-12 May, 2026 | 08:21
Updated-14 Jul, 2026 | 10:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the authenticated user's session without requiring the file to be uploaded, potentially leading to session hijacking or credential theft.

Action-Not Available
Vendor-Siemens AG
Product-SIMATIC S7-1500 Software Controller CPU 1507S F V2SIMATIC S7-1500 Software Controller CPU 1508S TF V3SIPLUS S7-1500 CPU 1518-4 PN/DPSIMATIC S7-1500 CPU 1517F-3 PNSIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODKSIPLUS ET 200SP CPU 1512SP-1 PNSIMATIC S7-1500 CPU 1512C-1 PNSIPLUS S7-1500 CPU 1511-1 PNSIMATIC ET 200SP CPU 1514SPT F-2 PNSIMATIC S7-1500 CPU 1516TF-3 PN/DPSIPLUS S7-1500 CPU 1513-1 PNSIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PNSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUsSIMATIC S7-1500 Software Controller CPU 1508S F V2SIMATIC S7-1500 CPU 1515-2 PNSIMATIC S7-1500 CPU 1518F-3 PNSIMATIC S7-1500 CPU 1518T-3 PNSIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PNSIPLUS S7-1500 CPU 1516-3 PN/DPSIPLUS S7-1500 CPU 1518-4 PN/DP MFPSIMATIC S7-1500 Software Controller CPU 1507S F V4SIMATIC S7-1500 CPU 1511C-1 PNSIMATIC S7-1500 CPU 1517-3 PN/DPSIMATIC S7-1500 Software Controller CPU 1508S V4SIPLUS S7-1500 CPU 1516F-3 PN/DP RAILSIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PNSIMATIC S7-1500 Software Controller CPU 1508S T V3SIMATIC S7-1500 CPU 1516pro F-2 PNSIMATIC S7-1500 Software Controller Linux V3SIMATIC S7-1500 CPU 1516T-3 PN/DPSIMATIC S7-1500 CPU 1517T-3 PNSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPSIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PNSIMATIC S7-1500 CPU 1518TF-4 PN/DPSIMATIC Drive Controller CPU 1504D TFSIMATIC ET 200SP CPU 1512SP F-1 PNSIMATIC S7-1500 Software Controller Linux V2SIMATIC S7-1500 CPU 1517TF-3 PN/DPSIPLUS S7-1500 CPU 1511-1 PN TX RAILSIMATIC S7-1500 CPU 1517T-3 PN/DPSIPLUS ET 200SP CPU 1510SP F-1 PN RAILSIMATIC S7-1500 CPU 1516F-3 PN/DPSIMATIC S7-1500 CPU 1517F-3 PN/DPSIMATIC S7-1500 CPU 1513pro F-2 PNSIPLUS ET 200SP CPU 1510SP-1 PNSIPLUS S7-1500 CPU 1516-3 PN/DP RAILSIMATIC ET 200SP CPU 1514SPT-2 PNSIMATIC S7-1500 CPU 1516pro-2 PNSIMATIC S7-1500 Software Controller CPU 1508S F V4SIMATIC ET 200SP CPU 1510SP-1 PNSIMATIC S7-1500 Software Controller CPU 1507S V2SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)SIMATIC S7-1500 Software Controller CPU 1508S V2SIPLUS S7-1500 CPU 1511-1 PN T1 RAILSIMATIC S7-1500 CPU 1516-3 PN/DPSIMATIC Drive Controller CPU 1507D TFSIMATIC S7-1500 CPU S7-1518-4 PN/DP ODKSIMATIC S7-1500 CPU 1511TF-1 PNSIMATIC S7-1500 Software Controller CPU 1507S V4SIMATIC S7-1500 CPU 1513pro-2 PNSIMATIC S7-1500 CPU 1517TF-3 PNSIPLUS ET 200SP CPU 1512SP F-1 PN RAILSIMATIC S7-1500 Software Controller CPU 1508S F V3SIPLUS ET 200SP CPU 1510SP-1 PN RAILSIMATIC S7-1500 CPU 1513F-1 PNSIMATIC ET 200SP Open Controller CPU 1515SP PC3 V4 CPUsSIMATIC S7-1500 CPU 1513-1 PNSIMATIC S7-1500 CPU 1511-1 PNSIMATIC S7-1500 Software Controller CPU 1507S F V3SIPLUS S7-1500 CPU 1518F-4 PN/DPSIMATIC S7-1500 CPU 1518T-4 PN/DPSIMATIC S7-1500 CPU 1517-3 PNSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUsSIPLUS S7-1500 CPU 1515F-2 PNSIMATIC S7-PLCSIM AdvancedSIMATIC ET 200SP CPU 1510SP F-1 PNSIMATIC S7-1500 CPU 1515T-2 PNSIMATIC S7-1500 CPU 1515TF-2 PNSIMATIC S7-1500 CPU 1518-4 PN/DPSIPLUS S7-1500 CPU 1515F-2 PN T2 RAILSIPLUS S7-1500 CPU 1516F-3 PN/DPSIMATIC S7-1500 Software Controller CPU 1507S V3SIPLUS ET 200SP CPU 1512SP F-1 PNSIPLUS S7-1500 CPU 1515F-2 PN RAILSIPLUS S7-1500 CPU 1516-3 PN/DP TX RAILSIPLUS ET 200SP CPU 1510SP F-1 PNSIMATIC S7-1500 CPU 1511F-1 PNSIMATIC S7-1500 CPU 1515F-2 PNSIMATIC S7-1500 CPU 1518F-4 PN/DPSIMATIC ET 200SP CPU 1514SP-2 PNSIMATIC S7-1500 CPU 1518-3 PNSIMATIC S7-1500 Software Controller CPU 1508S V3SIMATIC ET 200SP CPU 1512SP-1 PNSIMATIC ET 200SP CPU 1514SP F-2 PNSIMATIC S7-1500 CPU 1518-4 PN/DP MFPSIMATIC S7-1500 CPU 1516T-3 PNSIMATIC S7-1500 CPU 1511T-1 PNSIPLUS S7-1500 CPU 1511F-1 PNSIPLUS S7-1500 CPU 1513F-1 PNSIPLUS ET 200SP CPU 1512SP-1 PN RAILSIMATIC S7-1500 CPU 1518TF-3 PNSIMATIC S7-1500 CPU 1516TF-3 PN
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-40176
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-8||HIGH
EPSS-1.15% / 63.25%
||
7 Day CHG~0.00%
Published-11 Oct, 2022 | 00:00
Updated-03 Aug, 2024 | 12:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). There exists an Improper Neutralization of Special Elements used in an OS Command with root privileges during a restore operation due to the missing validation of the names of files included in the input package. By restoring a specifically crafted package, a remote low-privileged attacker can execute arbitrary system commands with root privileges on the device, leading to a full compromise.

Action-Not Available
Vendor-Siemens AG
Product-pxg3.w200-1pxg3.w200-2_firmwaredesigo_pxm50.edesigo_pxm40.e_firmwaredesigo_pxm50.e_firmwaredesigo_pxm40-1_firmwaredesigo_pxm30.edesigo_pxm40-1pxg3.w100-2_firmwaredesigo_pxm50-1_firmwaredesigo_pxm30-1desigo_pxm30.e_firmwaredesigo_pxm50-1pxg3.w100-1desigo_pxm40.epxg3.w100-1_firmwarepxg3.w200-1_firmwaredesigo_pxm30-1_firmwarepxg3.w100-2pxg3.w200-2Desigo PXM50-1PXG3.W100-1Desigo PXM40-1Desigo PXM50.EPXG3.W100-2Desigo PXM40.EDesigo PXM30.EPXG3.W200-1Desigo PXM30-1PXG3.W200-2
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-34663
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-8||HIGH
EPSS-0.84% / 53.93%
||
7 Day CHG~0.00%
Published-12 Jul, 2022 | 10:07
Updated-12 Aug, 2025 | 12:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2100PNC (32M) V4.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. Affected devices are vulnerable to a web-based code injection attack via the console. An attacker could exploit this vulnerability to inject code into the web server and cause malicious behavior in legitimate users accessing certain web resources on the affected device.

Action-Not Available
Vendor-Siemens AG
Product-ruggedcom_rs969ruggedcom_rsg2100_\(32m\)ruggedcom_rs910ruggedcom_rsg2100ruggedcom_rsg2300pruggedcom_rs930lruggedcom_rsg907rruggedcom_rsg910cruggedcom_rs416ruggedcom_rs900wruggedcom_rs900_\(32m\)ruggedcom_i801ruggedcom_rosruggedcom_m2100ruggedcom_rmcruggedcom_i800ruggedcom_rst2228ruggedcom_rs930wruggedcom_rmc8388ruggedcom_rsg2200ruggedcom_rsg909rruggedcom_rs401ruggedcom_rs8000truggedcom_rp110ruggedcom_rs910lruggedcom_i802ruggedcom_m969ruggedcom_rs900g_\(32m\)ruggedcom_rs910wruggedcom_rsg2100pruggedcom_rs8000ruggedcom_rst916pruggedcom_rs900gpruggedcom_rs900lruggedcom_rmc40ruggedcom_rsl910ruggedcom_rmc41ruggedcom_rsg920pruggedcom_rs920wruggedcom_rs416v2ruggedcom_rs8000aruggedcom_rsg2300ruggedcom_rst916cruggedcom_m2200ruggedcom_rs400ruggedcom_rst2228pruggedcom_rmc20ruggedcom_rs8000hruggedcom_rsg908cruggedcom_i803ruggedcom_rsg2488ruggedcom_rs900gruggedcom_rsg2288ruggedcom_rs920lruggedcom_rs940gruggedcom_rmc30RUGGEDCOM RS8000RUGGEDCOM RS900LRUGGEDCOM RSG2300 V4.XRUGGEDCOM RS900MNC-STND-XX-C01RUGGEDCOM RSG920P V4.XRUGGEDCOM RS401NCRUGGEDCOM RSG2100PNC (32M) V4.XRUGGEDCOM RS920LNCRUGGEDCOM RS910LRUGGEDCOM RS930WRUGGEDCOM RSG2100NC(32M) V5.XRUGGEDCOM RSG2100 (32M) V5.XRUGGEDCOM RSG2288NC V5.XRUGGEDCOM RS416Pv2 V4.XRUGGEDCOM RS1600RUGGEDCOM i801NCRUGGEDCOM RS940GRUGGEDCOM RSG2100NC(32M) V4.XRUGGEDCOM i800NCRUGGEDCOM RS910RUGGEDCOM RSG908CRUGGEDCOM RS8000NCRUGGEDCOM RS400FRUGGEDCOM RS900NC(32M) V4.XRUGGEDCOM RS920LRUGGEDCOM RMC8388 V4.XRUGGEDCOM RS8000HRUGGEDCOM RS900LNCRUGGEDCOM RS8000TRUGGEDCOM RS910NCRUGGEDCOM RS416PFRUGGEDCOM RS900GRUGGEDCOM M2100FRUGGEDCOM RS900M-STND-XXRUGGEDCOM RS900WRUGGEDCOM RMC8388 V5.XRUGGEDCOM RS900MNC-STND-XXRUGGEDCOM RSG2100PNC (32M) V5.XRUGGEDCOM RSG910CRUGGEDCOM RSG2300PFRUGGEDCOM RSG2288 V4.XRUGGEDCOM RS1600NCRUGGEDCOM RS969RUGGEDCOM RS900 (32M) V4.XRUGGEDCOM RSG909RRUGGEDCOM RS416FRUGGEDCOM RS900GPFRUGGEDCOM RSG2100PRUGGEDCOM RS930LNCRUGGEDCOM RS416PRUGGEDCOM RSG920P V5.XRUGGEDCOM RSG2200NCRUGGEDCOM RS8000HNCRUGGEDCOM RSG2300PNC V5.XRUGGEDCOM RSG2288 V5.XRUGGEDCOM RS1600FRUGGEDCOM RS416NCRUGGEDCOM RS930LRUGGEDCOM RSG907RRUGGEDCOM RSG2300P V5.XRUGGEDCOM RS910WRUGGEDCOM RSG2300 V5.XRUGGEDCOM RS940GNCRUGGEDCOM RS900GNCRUGGEDCOM RSG2100P (32M) V4.XRUGGEDCOM RMC8388NC V5.XRUGGEDCOM RS940GFRUGGEDCOM RS910LNCRUGGEDCOM RSG2288NC V4.XRUGGEDCOM RSG2488 V5.XRUGGEDCOM RMC30RUGGEDCOM RS900GFRUGGEDCOM RS8000ANCRUGGEDCOM RMC8388NC V4.XRUGGEDCOM RS1600TRUGGEDCOM M969FRUGGEDCOM RS900G (32M) V5.XRUGGEDCOM RS400NCRUGGEDCOM RS900MNC-GETS-C01RUGGEDCOM RS900M-GETS-C01RUGGEDCOM RSG2488NC V4.XRUGGEDCOM M2200FRUGGEDCOM RP110RUGGEDCOM i801RUGGEDCOM RS416v2 V4.XRUGGEDCOM RS416NCv2 V4.XRUGGEDCOM RS8000TNCRUGGEDCOM RSG2300P V4.XRUGGEDCOM RS416v2 V5.XRUGGEDCOM RS920WRUGGEDCOM RS900FRUGGEDCOM M2200RUGGEDCOM RS900MNC-GETS-XXRUGGEDCOM RSG2300NC V5.XRUGGEDCOM RS900GNC(32M) V4.XRUGGEDCOM RS900RUGGEDCOM RSG2100RUGGEDCOM M969NCRUGGEDCOM RS416PNCRUGGEDCOM RS1600FNCRUGGEDCOM RS400RUGGEDCOM RS900NC(32M) V5.XRUGGEDCOM RS1600TNCRUGGEDCOM RS900G (32M) V4.XRUGGEDCOM M969RUGGEDCOM RS416PNCv2 V4.XRUGGEDCOM M2200NCRUGGEDCOM RS8000ARUGGEDCOM i803RUGGEDCOM RSG2100PNCRUGGEDCOM RSG920PNC V5.XRUGGEDCOM RSG2100NCRUGGEDCOM RSG2488FRUGGEDCOM RP110NCRUGGEDCOM RSG2200RUGGEDCOM RSG2488NC V5.XRUGGEDCOM RSL910NCRUGGEDCOM RS969NCRUGGEDCOM RS416RUGGEDCOM RST2228PRUGGEDCOM i800RUGGEDCOM RS900M-STND-C01RUGGEDCOM RS900M-GETS-XXRUGGEDCOM RST916PRUGGEDCOM RS416PNCv2 V5.XRUGGEDCOM RS416NCv2 V5.XRUGGEDCOM RSG2100 (32M) V4.XRUGGEDCOM RSL910RUGGEDCOM RSG2100PFRUGGEDCOM RS900GPRUGGEDCOM RST916CRUGGEDCOM RS900GPNCRUGGEDCOM RSG2100FRUGGEDCOM RSG2488 V4.XRUGGEDCOM i802RUGGEDCOM RS900GNC(32M) V5.XRUGGEDCOM RST2228RUGGEDCOM RS401RUGGEDCOM RSG2300NC V4.XRUGGEDCOM RSG920PNC V4.XRUGGEDCOM i802NCRUGGEDCOM i803NCRUGGEDCOM M2100RUGGEDCOM RSG2300FRUGGEDCOM RSG2300PNC V4.XRUGGEDCOM RS900NCRUGGEDCOM RS416Pv2 V5.XRUGGEDCOM RMC30NCRUGGEDCOM RS900 (32M) V5.XRUGGEDCOM RSG2200FRUGGEDCOM M2100NCRUGGEDCOM RSG2100P (32M) V5.X
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2022-33137
Matching Score-8
Assigner-Siemens
ShareView Details
Matching Score-8
Assigner-Siemens
CVSS Score-8||HIGH
EPSS-0.82% / 53.08%
||
7 Day CHG~0.00%
Published-12 Jul, 2022 | 10:06
Updated-03 Aug, 2024 | 08:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions.

Action-Not Available
Vendor-Siemens AG
Product-simatic_mv540_s_firmwaresimatic_mv540_ssimatic_mv560_x_firmwaresimatic_mv560_usimatic_mv560_u_firmwaresimatic_mv550_s_firmwaresimatic_mv540_hsimatic_mv550_h_firmwaresimatic_mv550_ssimatic_mv560_xsimatic_mv550_hsimatic_mv540_h_firmwareSIMATIC MV560 USIMATIC MV540 SSIMATIC MV540 HSIMATIC MV550 HSIMATIC MV550 SSIMATIC MV560 X
CWE ID-CWE-613
Insufficient Session Expiration
Details not found