Skip to content
OpenAdvisories
Medium SSA-787941 1 CVE

SSA-787941: Denial of Service Vulnerability in RUGGEDCOM ROS devices

Published Nov 8, 2022 · Updated Aug 12, 2025 · Revision 6

Vendor: Siemens Product: RUGGEDCOM i800 Product: RUGGEDCOM i800NC Product: RUGGEDCOM i801 Product: RUGGEDCOM i801NC Product: RUGGEDCOM i802 Product: RUGGEDCOM i802NC Product: RUGGEDCOM i803 Product: RUGGEDCOM i803NC Product: RUGGEDCOM M2100 Product: RUGGEDCOM M2100F Product: RUGGEDCOM M2100NC Product: RUGGEDCOM M2200 Product: RUGGEDCOM M2200F Product: RUGGEDCOM M2200NC Product: RUGGEDCOM M969 Product: RUGGEDCOM M969F Product: RUGGEDCOM M969NC Product: RUGGEDCOM RMC30 Product: RUGGEDCOM RMC30NC Product: RUGGEDCOM RMC8388 V4.X Product: RUGGEDCOM RMC8388 V5.X Product: RUGGEDCOM RMC8388NC V4.X Product: RUGGEDCOM RMC8388NC V5.X Product: RUGGEDCOM RP110 Product: RUGGEDCOM RP110NC Product: RUGGEDCOM RS1600 Product: RUGGEDCOM RS1600F Product: RUGGEDCOM RS1600FNC Product: RUGGEDCOM RS1600NC +121 more

Summary

RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP connections. The web server recovers by itself once the attack ends.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #6

    Added RUGGEDCOM RSG2100P (32M) and RUGGEDCOM RSG2100PNC (32M) for V4.x and V5.x

  2. #5

    Added missing affected products: RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416PNCv2 V4.x, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416Pv2 V4.X. Adjusted the name of RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416PNCv2 V5.x, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS416Pv2 V5.X (added reference to V5.X). Added RUGGEDCOM ROS V5.X products and respective fix (V5.6.0). Adjusted title and summary. Added "No fix planned" for NC products

  3. #4

    Added missing affected products with fix planned: RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RS416NC v2, RUGGEDCOM RS416PNC v2, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910NC

  4. #3

    Added multiple missing affected products with no fix currently planned

  5. #2

    Added missing affected products. Added fix to multiple products (V4.3.8)

  6. #1

    Publication Date

References