Vulnerability · Published Jul 9, 2024 · Assigned by siemens
CVE-2023-52238
Medium 4.3
In plain English
A medium-severity information exposure in RUGGEDCOM RST2228 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected systems leaks the MACSEC key in clear text to a logged in user. An attacker with the credentials of a low privileged user could retrieve the MACSEC key and access (decrypt) the ethernet frames sent by authorized recipients.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | RUGGEDCOM RST2228 | 0 – before V5.9.0 |
| Siemens | RUGGEDCOM RST2228P | 0 – before V5.9.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C