Skip to content
OpenAdvisories
Medium SSA-764417 1 CVE

SSA-764417: Weak Encryption Vulnerability in RUGGEDCOM ROS Devices

Published Mar 8, 2022 · Updated Aug 12, 2025 · Revision 10

Vendor: Siemens Product: RUGGEDCOM i800 Product: RUGGEDCOM i801 Product: RUGGEDCOM i802 Product: RUGGEDCOM i803 Product: RUGGEDCOM M2100 Product: RUGGEDCOM M2200 Product: RUGGEDCOM M969 Product: RUGGEDCOM RMC30 Product: RUGGEDCOM RMC8388 V4.X Product: RUGGEDCOM RMC8388 V5.X Product: RUGGEDCOM RP110 Product: RUGGEDCOM RS1600 Product: RUGGEDCOM RS1600F Product: RUGGEDCOM RS1600T Product: RUGGEDCOM RS400 Product: RUGGEDCOM RS401 Product: RUGGEDCOM RS416 Product: RUGGEDCOM RS416P Product: RUGGEDCOM RS416Pv2 V4.X Product: RUGGEDCOM RS416Pv2 V5.X Product: RUGGEDCOM RS416v2 V4.X Product: RUGGEDCOM RS416v2 V5.X Product: RUGGEDCOM RS8000 Product: RUGGEDCOM RS8000A Product: RUGGEDCOM RS8000H Product: RUGGEDCOM RS8000T Product: RUGGEDCOM RS900 Product: RUGGEDCOM RS900 (32M) V4.X Product: RUGGEDCOM RS900 (32M) V5.X +45 more

Summary

The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device.

Siemens has released new versions for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

Revision history

  1. #10

    Added RUGGEDCOM RSG2100P (32M) for V4.x and V5.x

  2. #9

    Added missing affected products: RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416Pv2 V4.X. Adjusted the name of RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS416Pv2 V5.X (added reference to V5.X). Added RUGGEDCOM RSG2100P (32M) for V4.x and V5.x.

  3. #8

    Added missing affected products. Added fix for RUGGEDCOM ROS devices using V4.X

  4. #7

    Added fix for RUGGEDCOM ROS V5.X devices

  5. #6

    Reflect information about an upcoming fix. Highlight version lines of the affected devices

  6. #5

    Reflected a more accurate fix status in advisory

  7. #4

    Corrected title, vulnerability description, CVSS vector and CWE ID; clarified that a fix release is currently not available for affected devices

  8. #3

    Added acknowledgements

  9. #2

    Corrected the list of affected products and fix releases

  10. #1

    Publication Date

References