Critical SSA-146325 21 CVEs

SSA-146325: Multiple Vulnerabilities in RUGGEDCOM ROX before V2.16

Published Jul 11, 2023 · Updated Jul 11, 2023

Vendor: Siemens Product: RUGGEDCOM ROX MX5000 Product: RUGGEDCOM ROX MX5000RE Product: RUGGEDCOM ROX RX1400 Product: RUGGEDCOM ROX RX1500 Product: RUGGEDCOM ROX RX1501 Product: RUGGEDCOM ROX RX1510 Product: RUGGEDCOM ROX RX1511 Product: RUGGEDCOM ROX RX1512 Product: RUGGEDCOM ROX RX1524 Product: RUGGEDCOM ROX RX1536 Product: RUGGEDCOM ROX RX5000

Summary

Devices based on RUGGEDCOM ROX before V2.16 contain multiple high severity vulnerabilities, including the third-party vulnerabilities: CVE-2022-24903, CVE-2022-2068, CVE-2021-22946, CVE-2022-22576, CVE-2022-27781, CVE-2022-27782, CVE-2022-32207, CVE-2022-1292.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 21

Critical 9.8

CVE-2022-1292 Public exploit EPSS 83%

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux

May 3, 2022
Critical 9.8

CVE-2022-2068 EPSS 96%

The c_rehash script allows command injection

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux

Jun 21, 2022
Critical 9.8

CVE-2022-32207 EPSS 12%

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022
Critical 9.1

CVE-2023-36750

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX5000 RUGGEDCOM ROX RX1500 RUGGEDCOM ROX RX1510 ICS / OT

Jul 11, 2023
Critical 9.1

CVE-2023-36751

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX5000 RUGGEDCOM ROX RX1500 RUGGEDCOM ROX RX1510 ICS / OT

Jul 11, 2023
Critical 9.1

CVE-2023-36752

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1512 RUGGEDCOM ROX MX5000 RUGGEDCOM ROX RX1536 ICS / OT

Jul 11, 2023
Critical 9.1

CVE-2023-36753

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1501 RUGGEDCOM ROX RX1511 RUGGEDCOM ROX RX1524 ICS / OT

Jul 11, 2023
Critical 9.1

CVE-2023-36754

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1501 RUGGEDCOM ROX RX1511 RUGGEDCOM ROX RX1524 ICS / OT

Jul 11, 2023
Critical 9.1

CVE-2023-36755

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1511 RUGGEDCOM ROX RX1524 RUGGEDCOM ROX RX5000 ICS / OT

Jul 11, 2023
High 8.8

CVE-2023-36386

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1500 RUGGEDCOM ROX RX1510 RUGGEDCOM ROX RX1512 ICS / OT

Jul 11, 2023
High 8.8

CVE-2023-36389

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1511 RUGGEDCOM ROX RX1524 RUGGEDCOM ROX RX5000 ICS / OT

Jul 11, 2023
High 8.8

CVE-2023-36390

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1512 RUGGEDCOM ROX MX5000 RUGGEDCOM ROX RX1536 ICS / OT

Jul 11, 2023
High 8.1

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-a…

curl curl curl Debian Ubuntu Alpine

May 26, 2022
High 8.1

CVE-2022-24903 Public exploit

Buffer overflow in TCP syslog server (receiver) components in rsyslog

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability…

rsyslog rsyslog rsyslog rsyslog Debian Ubuntu Azure Linux Alpine

May 5, 2022
High 7.5

CVE-2021-22946

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Sep 29, 2021
High 7.5

CVE-2022-27781

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jun 1, 2022
High 7.5

CVE-2022-27782

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jun 1, 2022
High 7.5

CVE-2022-29561

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1536 RUGGEDCOM ROX RX1400 RUGGEDCOM ROX RX1501 ICS / OT

Jul 11, 2023
High 7.4

CVE-2023-36749

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1536 RUGGEDCOM ROX RX1400 RUGGEDCOM ROX RX1501 ICS / OT

Jul 11, 2023
Medium 5.9

CVE-2023-36748

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX MX5000 RUGGEDCOM ROX RX1536 RUGGEDCOM ROX RX1400 ICS / OT

Jul 11, 2023
Low 3.7

CVE-2022-29562

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

Siemens RUGGEDCOM ROX RX1510 RUGGEDCOM ROX RX1512 RUGGEDCOM ROX MX5000 ICS / OT

Jul 11, 2023

Revision history

2023-07-11 #1
Publication Date

References

SSA-146325: Multiple Vulnerabilities in RUGGEDCOM ROX before V2.16 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-146325.html
SSA-146325: Multiple Vulnerabilities in RUGGEDCOM ROX before V2.16 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf
SSA-146325: Multiple Vulnerabilities in RUGGEDCOM ROX before V2.16 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-146325.txt