Skip to content
OpenAdvisories
Critical SSA-256353 6 CVEs

SSA-256353: Third-Party Component Vulnerabilities in RUGGEDCOM ROS

Published Mar 8, 2022 · Updated Aug 12, 2025 · Revision 7

Vendor: Siemens Product: RUGGEDCOM i800 Product: RUGGEDCOM i800NC Product: RUGGEDCOM i801 Product: RUGGEDCOM i801NC Product: RUGGEDCOM i802 Product: RUGGEDCOM i802NC Product: RUGGEDCOM i803 Product: RUGGEDCOM i803NC Product: RUGGEDCOM M2100 Product: RUGGEDCOM M2100F Product: RUGGEDCOM M2100NC Product: RUGGEDCOM M2200 Product: RUGGEDCOM M2200F Product: RUGGEDCOM M2200NC Product: RUGGEDCOM M969 Product: RUGGEDCOM M969F Product: RUGGEDCOM M969NC Product: RUGGEDCOM RMC30 Product: RUGGEDCOM RMC30NC Product: RUGGEDCOM RMC8388 V4.X Product: RUGGEDCOM RMC8388 V5.X Product: RUGGEDCOM RMC8388NC V4.X Product: RUGGEDCOM RMC8388NC V5.X Product: RUGGEDCOM RP110 Product: RUGGEDCOM RP110NC Product: RUGGEDCOM RS1600 Product: RUGGEDCOM RS1600F Product: RUGGEDCOM RS1600FNC Product: RUGGEDCOM RS1600NC +121 more

Summary

Multiple vulnerabilities affect various third-party components of the RUGGEDCOM Operating System (ROS). If exploited, an attacker could cause a denial-of-service, act as a man-in-the-middle or retrieval of sensitive information or gain privileged functions.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 6

Revision history

  1. #7

    Added RUGGEDCOM RSG2100P (32M) and RUGGEDCOM RSG2100PNC (32M) for V4.x and V5.x

  2. #6

    Added missing affected products: RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416PNCv2 V4.x, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416Pv2 V4.X. Adjusted the name of RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416PNCv2 V5.x, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS416Pv2 V5.X (added reference to V5.X). Added Additional note for FIPS devices

  3. #5

    Added multiple missing affected products (only affected by CVE-2021-37208, CVE-2021-42016, CVE-2021-42017, CVE-2021-42018 and CVE-2021-42019) with no fix currently planned

  4. #4

    Corrected the list of affected products and added fix for V4.3.8

  5. #3

    Added acknowledgements

  6. #2

    Corrected the list of affected products and fix releases

  7. #1

    Publication Date

References