Skip to content
OpenAdvisories
High SSA-406691 1 CVE

SSA-406691: Buffer Vulnerabilities in DHCP function of RUGGEDCOM ROX products

Published Mar 8, 2022 · Updated Mar 8, 2022

Vendor: Siemens Product: RUGGEDCOM ROX MX5000 Product: RUGGEDCOM ROX RX1400 Product: RUGGEDCOM ROX RX1500 Product: RUGGEDCOM ROX RX1501 Product: RUGGEDCOM ROX RX1510 Product: RUGGEDCOM ROX RX1511 Product: RUGGEDCOM ROX RX1512 Product: RUGGEDCOM ROX RX1524 Product: RUGGEDCOM ROX RX1536 Product: RUGGEDCOM ROX RX5000

Summary

A vulnerability in the RUGGEDCOM ROX devices' third party component, ISC DHCP, could allow an attacker to cause a buffer overrun due to a bug when reading a stored DHCP lease containing certain option information, eventually leading to a denial-of-service condition, or cause a remote-code execution.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

  • High 7.4
    CVE-2021-25217

    A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient

    In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is …

    ISC ISC DHCP isc-dhcp isc-dhcp Debian Ubuntu Azure Linux Alpine

Revision history

  1. #1

    Publication Date

References