Vulnerability · Published Mar 15, 2021 · Assigned by siemens
CVE-2021-25676
High 7.5
In plain English
A high-severity security flaw in RUGGEDCOM RM1224 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.3%top 28.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | RUGGEDCOM RM1224 | V6.3 |
| Siemens | SCALANCE M-800 | V6.3 |
| Siemens | SCALANCE S615 | V6.3 |
| Siemens | SCALANCE SC-600 | All Versions >= V2.1 and < V2.1.3 |
Weakness: CWE-307
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf x_refsource_MISC
- https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02 x_refsource_CONFIRM