Skip to content
OpenAdvisories
High ICSA-23-285-07 7 CVEs

Siemens RUGGEDCOM APE180

Published Oct 10, 2023 · Updated May 14, 2024 · Revision 3

Vendor: Siemens Product: RUGGEDCOM APE1808

Summary

Nozomi Networks has published information on vulnerabilities in
Nozomi Guardian/CMC before V22.6.2. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.
Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available. Customers are advised to consult and implement the workarounds provided in Nozomi Network's upstream security notifications.

Vulnerabilities 7

  • High 8.8
    CVE-2023-22378

    Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2

    A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated use…

    Nozomi Networks CMC Guardian
  • High 8.8
    CVE-2023-23574

    Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2

    A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticate…

    Nozomi Networks CMC Guardian
  • High 7.0
    CVE-2023-24477

    Session Fixation in Guardian/CMC before 22.6.2

    In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user'…

    Nozomi Networks CMC Guardian
  • Medium 6.5
    CVE-2023-24471

    Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2

    An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality. An authenticated user with reduced visibility can obtain unauthorized information via the debug functiona…

    Nozomi Networks CMC Guardian
  • Medium 6.4
    CVE-2023-22843

    Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

    An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the…

    Nozomi Networks CMC Guardian
  • Medium 4.9
    CVE-2023-23903

    DoS via SAML configuration in Guardian/CMC before 22.6.2

    An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. The whole application in rendered unusable until a…

    Nozomi Networks CMC Guardian
  • Medium 4.3
    CVE-2023-24015

    Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2

    A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, wit…

    Nozomi Networks CMC Guardian

Revision history

  1. #3

    Added specific product version to remediations

  2. #2

    Added solution for affected products

  3. #1

    Publication date

References