Log in Start free

Vulnerability · Published Jul 12, 2022 · Assigned by siemens

CVE-2022-29560

High 7.2

In plain English

A high-severity command injection in RUGGEDCOM ROX MX5000 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All versions < 2.15.1), RUGGEDCOM ROX RX1500 (All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions < 2.15.1), RUGGEDCOM ROX RX1510 (All versions < 2.15.1), RUGGEDCOM ROX RX1511 (All versions < 2.15.1), RUGGEDCOM ROX RX1512 (All versions < 2.15.1), RUGGEDCOM ROX RX1524 (All versions < 2.15.1), RUGGEDCOM ROX RX1536 (All versions < 2.15.1), RUGGEDCOM ROX RX5000 (All versions < 2.15.1). Affected devices do not properly validate user input, making them susceptible to command injection. An attacker with access to either the shell or the web CLI with administrator privileges could access the underlying operating system as the root user.

Affected products (as reported)

VendorProductVersions
Siemens RUGGEDCOM ROX MX5000 All versions < 2.15.1
Siemens RUGGEDCOM ROX MX5000RE All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1400 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1500 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1501 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1510 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1511 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1512 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1524 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX1536 All versions < 2.15.1
Siemens RUGGEDCOM ROX RX5000 All versions < 2.15.1

Weakness: CWE-77

References