Critical ICSA-23-222-05 5 CVEs

Siemens RUGGEDCOM CROSSBOW

Published Aug 8, 2023 · Updated May 6, 2025 · Revision 2

Vendor: Siemens Product: RUGGEDCOM CROSSBOW

Summary

The RUGGEDCOM CROSSBOW server application before V5.4 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, to create a denial of service condition, or to write arbitrary files to the application's file system.

Siemens has released an update for RUGGEDCOM CROSSBOW and recommends to update to the latest version.

Vulnerabilities 5

Critical 9.8

CVE-2023-37372

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerabl…

Siemens RUGGEDCOM CROSSBOW ICS / OT

Aug 8, 2023
High 8.8

CVE-2023-27411

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerabl…

Siemens RUGGEDCOM CROSSBOW ICS / OT

Aug 8, 2023
High 7.5

CVE-2021-31239

An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.…

sqlite3 Debian

May 9, 2023
High 7.1

CVE-2022-37971

Microsoft Windows Defender Elevation of Privilege Vulnerability

Microsoft Windows Defender Elevation of Privilege Vulnerability

Microsoft Microsoft Malware Protection Engine

Oct 11, 2022
Medium 5.3

CVE-2023-37373

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unaut…

Siemens RUGGEDCOM CROSSBOW ICS / OT

Aug 8, 2023

Revision history

2025-05-06 #2
Revision - Fixing typos
2023-08-08 #1
Publication date

References

SSA-472630: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.4 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-472630.html
SSA-472630: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.4 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-472630.pdf
SSA-472630: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.4 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-472630.txt
ICS Advisory ICSA-23-222-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-05
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B