Skip to content
OpenAdvisories
High SSA-840800 1 CVE

SSA-840800: Code Injection Vulnerability in RUGGEDCOM ROS

Published Jul 12, 2022 · Updated Aug 12, 2025 · Revision 6

Vendor: Siemens Product: RUGGEDCOM i800 Product: RUGGEDCOM i800NC Product: RUGGEDCOM i801 Product: RUGGEDCOM i801NC Product: RUGGEDCOM i802 Product: RUGGEDCOM i802NC Product: RUGGEDCOM i803 Product: RUGGEDCOM i803NC Product: RUGGEDCOM M2100 Product: RUGGEDCOM M2100F Product: RUGGEDCOM M2100NC Product: RUGGEDCOM M2200 Product: RUGGEDCOM M2200F Product: RUGGEDCOM M2200NC Product: RUGGEDCOM M969 Product: RUGGEDCOM M969F Product: RUGGEDCOM M969NC Product: RUGGEDCOM RMC30 Product: RUGGEDCOM RMC30NC Product: RUGGEDCOM RMC8388 V4.X Product: RUGGEDCOM RMC8388 V5.X Product: RUGGEDCOM RMC8388NC V4.X Product: RUGGEDCOM RMC8388NC V5.X Product: RUGGEDCOM RP110 Product: RUGGEDCOM RP110NC Product: RUGGEDCOM RS1600 Product: RUGGEDCOM RS1600F Product: RUGGEDCOM RS1600FNC Product: RUGGEDCOM RS1600NC +121 more

Summary

RUGGEDCOM ROS-based devices are vulnerable to a web-based code injection attack. To execute this attack, it
is necessary to access the system via the Command Line Interface (CLI).

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #6

    Added RUGGEDCOM RSG2100P (32M) and RUGGEDCOM RSG2100PNC (32M) for V4.x and V5.x

  2. #5

    Added missing affected products: RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416PNCv2 V4.x, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416Pv2 V4.X. Adjusted the name of RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416PNCv2 V5.x, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS416Pv2 V5.X (added reference to V5.X)

  3. #4

    Added multiple missing affected products with no fix currently planned

  4. #3

    Added multiple missing affected products. Added fix for V4.X devices

  5. #2

    Added RUGGEDCOM ROS RS1600, RS1600F, RS1600T and RS900 as affected products. Removed RMC, RMC20, RMC40 and RMC41 from affected products. Added new mitigation.

  6. #1

    Publication Date

References