Description
A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected systems leaks the MACSEC key in clear text to a logged in user. An attacker with the credentials of a low privileged user could retrieve the MACSEC key and access (decrypt) the ethernet frames sent by authorized recipients.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | RUGGEDCOM RST2228 | < V5.9.0 | V5.9.0 |
| Siemens | RUGGEDCOM RST2228P | < V5.9.0 | V5.9.0 |
Advisories 3
- ICSA-24-193-06 Siemens RUGGEDCOM CISA ICS & IT advisories · Aug 12, 2025
- SSA-170375 SSA-170375: Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9 Siemens ProductCERT · Aug 12, 2025
- NCSC-2024-0282 Kwetsbaarheden verholpen in Siemens Producten NCSC-NL (Netherlands) · Jul 9, 2024