Log in Start free

Vulnerability · Published Jul 9, 2024 · Assigned by siemens

CVE-2024-38278

Medium 6.6

In plain English

A medium-severity security flaw in RUGGEDCOM RMC8388 V5.X from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.3%top 71.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900GNC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100PNC (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300P V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG907R (All versions < V5.9.0), RUGGEDCOM RSG908C (All versions < V5.9.0), RUGGEDCOM RSG909R (All versions < V5.9.0), RUGGEDCOM RSG910C (All versions < V5.9.0), RUGGEDCOM RSG920P V5.X (All versions < V5.9.0), RUGGEDCOM RSG920PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSL910 (All versions < V5.9.0), RUGGEDCOM RSL910NC (All versions < V5.9.0), RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0), RUGGEDCOM RST916C (All versions < V5.9.0), RUGGEDCOM RST916P (All versions < V5.9.0). The affected products with IP forwarding enabled wrongly make available certain remote services in non-managed VLANs, even if these services are not intentionally activated. An attacker could leverage this vulnerability to create a remote shell to the affected system.

Affected products (as reported)

VendorProductVersions
Siemens RUGGEDCOM RMC8388 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RMC8388NC V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS416NCv2 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS416PNCv2 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS416Pv2 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS416v2 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS900 (32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS900G (32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS900GNC(32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RS900NC(32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2100 (32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2100NC(32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2100P (32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2100PNC (32M) V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2288 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2288NC V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2300 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2300NC V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2300P V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2300PNC V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2488 V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG2488NC V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG907R 0 – before V5.9.0
Siemens RUGGEDCOM RSG908C 0 – before V5.9.0
Siemens RUGGEDCOM RSG909R 0 – before V5.9.0
Siemens RUGGEDCOM RSG910C 0 – before V5.9.0
Siemens RUGGEDCOM RSG920P V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSG920PNC V5.X 0 – before V5.9.0
Siemens RUGGEDCOM RSL910 0 – before V5.9.0
Siemens RUGGEDCOM RSL910NC 0 – before V5.9.0

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References