Critical ICSA-24-137-10 9 CVEs

Siemens RUGGEDCOM CROSSBOW

Published May 14, 2024 · Updated May 14, 2024

Vendor: Siemens Product: RUGGEDCOM CROSSBOW

Summary

The RUGGEDCOM CROSSBOW server application before V5.5 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, or upload of arbitrary files to the application's file system. The majority of the reported vulnerabilities might have a high impact in the availability of the affected systems.

Siemens has released a new version for RUGGEDCOM CROSSBOW and recommends to update to the latest version.

Vulnerabilities 9

Critical 9.8

CVE-2024-27939

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow the upload …

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
High 8.8

CVE-2024-27940

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any authent…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
High 8.8

CVE-2024-27941

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected client systems do not pro…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
High 7.5

CVE-2024-27942

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any unauthe…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
High 7.2

CVE-2024-27943

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privilege…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
High 7.2

CVE-2024-27944

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privilege…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
High 7.2

CVE-2024-27945

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affecte…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
Medium 6.5

CVE-2024-27946

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). Downloading files overwrites files wit…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024
Medium 5.3

CVE-2024-27947

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems could allow log m…

Siemens RUGGEDCOM CROSSBOW ICS / OT

May 14, 2024

Revision history

2024-05-14 #1
Publication Date

References

SSA-916916: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.5 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-916916.html
SSA-916916: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.5 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-916916.pdf
SSA-916916: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.5 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-916916.txt
ICS Advisory ICSA-24-137-10 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-10
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B