Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2022-AVI-216
Vulnerability from certfr_avis - Published: 2022-03-08 - Updated: 2022-03-08
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
- Mendix Forgot Password Appstore module versions 3.2.x antérieures à 3.2.2
- Mendix Forgot Password Appstore module versions 3.3.x à 3.5.x antérieures à 3.5.1
- Mendix Applications utilisant Mendix versions 7.x antérieures à 7.23.29
- Mendix Applications utilisant Mendix versions 8.x antérieures à 8.18.16
- COMOS versions antérieures à 10.4.1
- Simcenter STAR-CCM+ Viewer versions antérieures à V2022.1
- SIMOTICS CONNECT 400 versions antérieures à 1.0.0.0
- Climatix POL909 (module AWB) versions antérieures à 11.44
- Climatix POL909 (module AWM) versions antérieures à 11.36
- RUGGEDCOM ROS M2100, RMC8388, RS416v2, RS900G, RS900G (32M), RSG900, RSG920P, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions antérieures à 5.6.0
- SINUMERIK MC versions antérieures à 1.15 SP1
- SINUMERIK ONE versions antérieures à 6.15 SP1
- SINEC INS versions antérieures à 1.0.1.1
- RUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 et RX5000 versions antérieures à 2.15.0
- Polarion Subversion Webclient versions antérieures à 21 R2 P2
- RUGGEDCOM ROS i800, i801, i802, i803, M969, M2100, M2200, RMC, RMC20, RMC30, RMC40, RMC41, RMC8388, RP110, RS400, RS401, RS416, RS416v2, RS900 (32M), RS900G, RS900G (32M), RS900GP, RS900L, RS900L, RS900W, RS910, RS910L, RS910W, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RS8000, RS8000A, RS8000H, RS8000T, RSG900, RSG900C, RSG900G, RSG900R, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSG2100, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2200, RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions antérieures à 5.6.0
L'éditeur ne propose pas de correctif pour :
- Mendix Applications utilisant Mendix versions 9
- SINEC NMS toutes versions
Se référer aux mesures de contournement proposées dans la section Documentation.
Impacted products
| Vendor | Product | Description |
|---|
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [],
"affected_systems_content": "\u003cul\u003e \u003cli\u003eMendix Forgot Password Appstore module versions 3.2.x ant\u00e9rieures \u00e0 3.2.2\u003c/li\u003e \u003cli\u003eMendix Forgot Password Appstore module versions 3.3.x \u00e0 3.5.x ant\u00e9rieures \u00e0 3.5.1\u003c/li\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 7.x ant\u00e9rieures \u00e0 7.23.29\u003c/li\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 8.x ant\u00e9rieures \u00e0 8.18.16\u003c/li\u003e \u003cli\u003eCOMOS versions ant\u00e9rieures \u00e0 10.4.1\u003c/li\u003e \u003cli\u003eSimcenter STAR-CCM+ Viewer versions ant\u00e9rieures \u00e0 V2022.1\u003c/li\u003e \u003cli\u003eSIMOTICS CONNECT 400 versions ant\u00e9rieures \u00e0 1.0.0.0\u003c/li\u003e \u003cli\u003eClimatix POL909 (module AWB) versions ant\u00e9rieures \u00e0 11.44\u003c/li\u003e \u003cli\u003eClimatix POL909 (module AWM) versions ant\u00e9rieures \u00e0 11.36\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROS M2100, RMC8388, RS416v2, RS900G, RS900G (32M), RSG900, RSG920P, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions ant\u00e9rieures \u00e0 5.6.0\u003c/li\u003e \u003cli\u003eSINUMERIK MC versions ant\u00e9rieures \u00e0 1.15 SP1\u003c/li\u003e \u003cli\u003eSINUMERIK ONE versions ant\u00e9rieures \u00e0 6.15 SP1\u003c/li\u003e \u003cli\u003eSINEC INS versions ant\u00e9rieures \u00e0 1.0.1.1\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536 et RX5000 versions ant\u00e9rieures \u00e0 2.15.0\u003c/li\u003e \u003cli\u003ePolarion Subversion Webclient versions ant\u00e9rieures \u00e0 21 R2 P2\u003c/li\u003e \u003cli\u003eRUGGEDCOM ROS i800, i801, i802, i803, M969, M2100, M2200, RMC, RMC20, RMC30, RMC40, RMC41, RMC8388, RP110, RS400, RS401, RS416, RS416v2, RS900 (32M), RS900G, RS900G (32M), RS900GP, RS900L, RS900L, RS900W, RS910, RS910L, RS910W, RS920L, RS920W, RS930L, RS930W, RS940G, RS969, RS8000, RS8000A, RS8000H, RS8000T, RSG900, RSG900C, RSG900G, RSG900R, RSG907R, RSG908C, RSG909R, RSG910C, RSG920P, RSG2100, RSG2100 (32M), RSG2100P, RSG2100P (32M), RSG2200, RSG2288, RSG2300, RSG2300P, RSG2488, RSL910, RST916C, RST916P et RST2228 versions ant\u00e9rieures \u00e0 5.6.0\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur ne propose pas de correctif pour :\u003c/p\u003e \u003cul\u003e \u003cli\u003eMendix Applications utilisant Mendix versions 9\u003c/li\u003e \u003cli\u003eSINEC NMS toutes versions\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eSe r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es dans la section Documentation.\u003c/p\u003e \u003cp\u003e\u0026nbsp;\u003c/p\u003e ",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-44478",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44478"
},
{
"name": "CVE-2021-22898",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22898"
},
{
"name": "CVE-2020-13871",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13871"
},
{
"name": "CVE-2021-42017",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42017"
},
{
"name": "CVE-2022-24282",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24282"
},
{
"name": "CVE-2021-25215",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25215"
},
{
"name": "CVE-2019-19317",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19317"
},
{
"name": "CVE-2020-8169",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8169"
},
{
"name": "CVE-2021-25174",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25174"
},
{
"name": "CVE-2021-22925",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22925"
},
{
"name": "CVE-2021-37701",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37701"
},
{
"name": "CVE-2021-32944",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32944"
},
{
"name": "CVE-2019-19244",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19244"
},
{
"name": "CVE-2021-27290",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-27290"
},
{
"name": "CVE-2021-42020",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42020"
},
{
"name": "CVE-2020-8285",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8285"
},
{
"name": "CVE-2021-22901",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22901"
},
{
"name": "CVE-2021-22940",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22940"
},
{
"name": "CVE-2021-32804",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32804"
},
{
"name": "CVE-2020-13632",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13632"
},
{
"name": "CVE-2022-24281",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24281"
},
{
"name": "CVE-2021-32936",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32936"
},
{
"name": "CVE-2021-22930",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22930"
},
{
"name": "CVE-2019-19926",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19926"
},
{
"name": "CVE-2020-9327",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9327"
},
{
"name": "CVE-2020-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8286"
},
{
"name": "CVE-2020-7774",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7774"
},
{
"name": "CVE-2021-22918",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22918"
},
{
"name": "CVE-2020-27304",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27304"
},
{
"name": "CVE-2021-32946",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32946"
},
{
"name": "CVE-2021-41543",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41543"
},
{
"name": "CVE-2020-8177",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8177"
},
{
"name": "CVE-2020-1971",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1971"
},
{
"name": "CVE-2020-13630",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13630"
},
{
"name": "CVE-2021-3450",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3450"
},
{
"name": "CVE-2021-22939",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22939"
},
{
"name": "CVE-2019-19646",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19646"
},
{
"name": "CVE-2021-40366",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40366"
},
{
"name": "CVE-2021-41542",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41542"
},
{
"name": "CVE-2021-41541",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41541"
},
{
"name": "CVE-2021-22924",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22924"
},
{
"name": "CVE-2022-24309",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24309"
},
{
"name": "CVE-2020-8265",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8265"
},
{
"name": "CVE-2021-37713",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37713"
},
{
"name": "CVE-2021-22947",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22947"
},
{
"name": "CVE-2019-19925",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19925"
},
{
"name": "CVE-2021-22922",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22922"
},
{
"name": "CVE-2019-19924",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19924"
},
{
"name": "CVE-2021-32938",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32938"
},
{
"name": "CVE-2020-11656",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11656"
},
{
"name": "CVE-2022-26317",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26317"
},
{
"name": "CVE-2021-22946",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22946"
},
{
"name": "CVE-2021-37712",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37712"
},
{
"name": "CVE-2020-8284",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8284"
},
{
"name": "CVE-2021-32940",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32940"
},
{
"name": "CVE-2021-3711",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3711"
},
{
"name": "CVE-2021-37208",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37208"
},
{
"name": "CVE-2021-32948",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32948"
},
{
"name": "CVE-2021-3449",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3449"
},
{
"name": "CVE-2022-26313",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26313"
},
{
"name": "CVE-2021-22921",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22921"
},
{
"name": "CVE-2021-25216",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25216"
},
{
"name": "CVE-2020-15358",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15358"
},
{
"name": "CVE-2021-43527",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43527"
},
{
"name": "CVE-2019-19242",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19242"
},
{
"name": "CVE-2021-22897",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22897"
},
{
"name": "CVE-2021-32803",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32803"
},
{
"name": "CVE-2021-25177",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25177"
},
{
"name": "CVE-2021-25175",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25175"
},
{
"name": "CVE-2021-22884",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22884"
},
{
"name": "CVE-2021-32952",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32952"
},
{
"name": "CVE-2019-19880",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19880"
},
{
"name": "CVE-2018-7160",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7160"
},
{
"name": "CVE-2021-32950",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-32950"
},
{
"name": "CVE-2021-3672",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3672"
},
{
"name": "CVE-2021-31346",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31346"
},
{
"name": "CVE-2022-26314",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26314"
},
{
"name": "CVE-2021-31784",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31784"
},
{
"name": "CVE-2021-22883",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22883"
},
{
"name": "CVE-2020-8231",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8231"
},
{
"name": "CVE-2020-13631",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13631"
},
{
"name": "CVE-2021-25214",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25214"
},
{
"name": "CVE-2021-22931",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22931"
},
{
"name": "CVE-2021-31889",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31889"
},
{
"name": "CVE-2022-24408",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24408"
},
{
"name": "CVE-2021-42016",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42016"
},
{
"name": "CVE-2021-3712",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3712"
},
{
"name": "CVE-2021-39134",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39134"
},
{
"name": "CVE-2019-19645",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19645"
},
{
"name": "CVE-2020-11655",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11655"
},
{
"name": "CVE-2020-8287",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8287"
},
{
"name": "CVE-2021-22926",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22926"
},
{
"name": "CVE-2022-24661",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24661"
},
{
"name": "CVE-2021-22890",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22890"
},
{
"name": "CVE-2021-25219",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25219"
},
{
"name": "CVE-2021-23840",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23840"
},
{
"name": "CVE-2021-42018",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42018"
},
{
"name": "CVE-2021-22923",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22923"
},
{
"name": "CVE-2019-19923",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19923"
},
{
"name": "CVE-2021-39135",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39135"
},
{
"name": "CVE-2021-25176",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25176"
},
{
"name": "CVE-2021-31890",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31890"
},
{
"name": "CVE-2021-25178",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25178"
},
{
"name": "CVE-2021-22876",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22876"
},
{
"name": "CVE-2021-23362",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23362"
},
{
"name": "CVE-2019-19603",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19603"
},
{
"name": "CVE-2021-25217",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25217"
},
{
"name": "CVE-2021-25173",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25173"
},
{
"name": "CVE-2021-22945",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22945"
},
{
"name": "CVE-2022-25311",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25311"
},
{
"name": "CVE-2021-31344",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31344"
},
{
"name": "CVE-2021-37209",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-37209"
},
{
"name": "CVE-2021-42019",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42019"
},
{
"name": "CVE-2020-8625",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8625"
}
],
"initial_release_date": "2022-03-08T00:00:00",
"last_revision_date": "2022-03-08T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-216",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-03-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-166747 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-166747.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-252466 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-252466.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-562051 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-562051.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-223353 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-223353.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-337210 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-337210.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-148641 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-148641.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-389290 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-389290.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-764417 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-764417.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-256353 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-256353.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-703715 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-703715.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-594438 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-594438.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-415938 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-415938.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-134279 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-134279.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-155599 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-155599.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-406691 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-406691.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-250085 du 8 mars 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-250085.html"
}
]
}
CVE-2021-37712 (GCVE-0-2021-37712)
Vulnerability from cvelistv5 – Published: 2021-08-31 00:00 – Updated: 2024-08-04 01:23
VLAI
EPSS
Title
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Summary
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.
Severity
8.2 (High)
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://www.npmjs.com/package/tar | |
| https://github.com/npm/node-tar/security/advisori… | |
| https://www.oracle.com/security-alerts/cpuoct2021.html | |
| https://www.debian.org/security/2021/dsa-5008 | vendor-advisory |
| https://cert-portal.siemens.com/productcert/pdf/s… | |
| https://lists.debian.org/debian-lts-announce/2022… | mailing-list |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:23:01.507Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.npmjs.com/package/tar"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "DSA-5008",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-5008"
},
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"name": "[debian-lts-announce] 20221212 [SECURITY] [DLA 3237-1] node-tar security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "node-tar",
"vendor": "npm",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.18"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.0.10"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.1.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 \"short path\" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://www.npmjs.com/package/tar"
},
{
"url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "DSA-5008",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2021/dsa-5008"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"name": "[debian-lts-announce] 20221212 [SECURITY] [DLA 3237-1] node-tar security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html"
}
],
"source": {
"advisory": "GHSA-qq89-hq3f-393p",
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-37712",
"datePublished": "2021-08-31T00:00:00.000Z",
"dateReserved": "2021-07-29T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:23:01.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-37713 (GCVE-0-2021-37713)
Vulnerability from cvelistv5 – Published: 2021-08-31 16:50 – Updated: 2024-08-04 01:23
VLAI
EPSS
Title
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Summary
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.
Severity
8.2 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.npmjs.com/package/tar | x_refsource_MISC |
| https://github.com/npm/node-tar/security/advisori… | x_refsource_CONFIRM |
| https://www.oracle.com/security-alerts/cpuoct2021.html | x_refsource_MISC |
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:23:01.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.npmjs.com/package/tar"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "node-tar",
"vendor": "npm",
"versions": [
{
"status": "affected",
"version": "\u003c 4.4.18"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.0.10"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.1.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\path`. If the drive letter does not match the extraction target, for example `D:\\extraction\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T14:07:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.npmjs.com/package/tar"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
],
"source": {
"advisory": "GHSA-5955-9wpr-37jh",
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-37713",
"STATE": "PUBLIC",
"TITLE": "Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "node-tar",
"version": {
"version_data": [
{
"version_value": "\u003c 4.4.18"
},
{
"version_value": "\u003e= 5.0.0, \u003c 5.0.10"
},
{
"version_value": "\u003e= 6.0.0, \u003c 6.1.9"
}
]
}
}
]
},
"vendor_name": "npm"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\path`. If the drive letter does not match the extraction target, for example `D:\\extraction\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.npmjs.com/package/tar",
"refsource": "MISC",
"url": "https://www.npmjs.com/package/tar"
},
{
"name": "https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh",
"refsource": "CONFIRM",
"url": "https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
]
},
"source": {
"advisory": "GHSA-5955-9wpr-37jh",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-37713",
"datePublished": "2021-08-31T16:50:09.000Z",
"dateReserved": "2021-07-29T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:23:01.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39134 (GCVE-0-2021-39134)
Vulnerability from cvelistv5 – Published: 2021-08-31 16:55 – Updated: 2024-08-04 01:58
VLAI
EPSS
Title
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Summary
`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above.
Severity
8.2 (High)
CWE
- CWE-61 - UNIX Symbolic Link (Symlink) Following
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/npm/arborist/security/advisori… | x_refsource_CONFIRM |
| https://www.npmjs.com/package/%40npmcli/arborist | x_refsource_MISC |
| https://www.oracle.com/security-alerts/cpuoct2021.html | x_refsource_MISC |
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:17.840Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.npmjs.com/package/%40npmcli/arborist"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "arborist",
"vendor": "npm",
"versions": [
{
"status": "affected",
"version": "\u003c 2.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist\u0027s internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `\"foo\": \"file:/some/path\"`. Another package, `pwn-b` could define a dependency such as `FOO: \"file:foo.tgz\"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T14:07:47.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.npmjs.com/package/%40npmcli/arborist"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
],
"source": {
"advisory": "GHSA-2h3h-q99f-3fhc",
"discovery": "UNKNOWN"
},
"title": "UNIX Symbolic Link (Symlink) Following in @npmcli/arborist",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39134",
"STATE": "PUBLIC",
"TITLE": "UNIX Symbolic Link (Symlink) Following in @npmcli/arborist"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "arborist",
"version": {
"version_data": [
{
"version_value": "\u003c 2.8.2"
}
]
}
}
]
},
"vendor_name": "npm"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist\u0027s internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `\"foo\": \"file:/some/path\"`. Another package, `pwn-b` could define a dependency such as `FOO: \"file:foo.tgz\"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-61: UNIX Symbolic Link (Symlink) Following"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc",
"refsource": "CONFIRM",
"url": "https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc"
},
{
"name": "https://www.npmjs.com/package/@npmcli/arborist",
"refsource": "MISC",
"url": "https://www.npmjs.com/package/@npmcli/arborist"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
]
},
"source": {
"advisory": "GHSA-2h3h-q99f-3fhc",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39134",
"datePublished": "2021-08-31T16:55:11.000Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:58:17.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39135 (GCVE-0-2021-39135)
Vulnerability from cvelistv5 – Published: 2021-08-31 17:10 – Updated: 2024-08-04 01:58
VLAI
EPSS
Title
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Summary
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.
Severity
8.2 (High)
CWE
- CWE-61 - UNIX Symbolic Link (Symlink) Following
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.npmjs.com/package/%40npmcli/arborist | x_refsource_MISC |
| https://github.com/npm/arborist/security/advisori… | x_refsource_CONFIRM |
| https://www.oracle.com/security-alerts/cpuoct2021.html | x_refsource_MISC |
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.npmjs.com/package/%40npmcli/arborist"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "arborist",
"vendor": "npm",
"versions": [
{
"status": "affected",
"version": "\u003c 2.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project\u0027s `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T14:07:30.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.npmjs.com/package/%40npmcli/arborist"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
],
"source": {
"advisory": "GHSA-gmw6-94gg-2rc2",
"discovery": "UNKNOWN"
},
"title": "UNIX Symbolic Link (Symlink) Following in @npmcli/arborist",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39135",
"STATE": "PUBLIC",
"TITLE": "UNIX Symbolic Link (Symlink) Following in @npmcli/arborist"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "arborist",
"version": {
"version_data": [
{
"version_value": "\u003c 2.8.2"
}
]
}
}
]
},
"vendor_name": "npm"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project\u0027s `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-61: UNIX Symbolic Link (Symlink) Following"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.npmjs.com/package/@npmcli/arborist",
"refsource": "MISC",
"url": "https://www.npmjs.com/package/@npmcli/arborist"
},
{
"name": "https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2",
"refsource": "CONFIRM",
"url": "https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
}
]
},
"source": {
"advisory": "GHSA-gmw6-94gg-2rc2",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39135",
"datePublished": "2021-08-31T17:10:10.000Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:58:18.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-40366 (GCVE-0-2021-40366)
Vulnerability from cvelistv5 – Published: 2021-11-09 11:32 – Updated: 2024-08-04 02:44
VLAI
EPSS
Summary
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.
Severity
No CVSS data available.
CWE
- CWE-311 - Missing Encryption of Sensitive Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | Climatix POL909 (AWB module) |
Affected:
All versions < V11.42
|
|
| Siemens | Climatix POL909 (AWM module) |
Affected:
All versions < V11.34
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:44:09.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Climatix POL909 (AWB module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.42"
}
]
},
{
"product": "Climatix POL909 (AWM module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.34"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.42), Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311: Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T11:31:09.000Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-40366",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Climatix POL909 (AWB module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.42"
}
]
}
},
{
"product_name": "Climatix POL909 (AWM module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.34"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.42), Climatix POL909 (AWM module) (All versions \u003c V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-311: Missing Encryption of Sensitive Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-40366",
"datePublished": "2021-11-09T11:32:07.000Z",
"dateReserved": "2021-09-01T00:00:00.000Z",
"dateUpdated": "2024-08-04T02:44:09.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41541 (GCVE-0-2021-41541)
Vulnerability from cvelistv5 – Published: 2022-03-08 11:31 – Updated: 2024-08-04 03:15
VLAI
EPSS
Summary
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.
Severity
No CVSS data available.
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | Climatix POL909 (AWB module) |
Affected:
All versions < V11.44
|
|
| Siemens | Climatix POL909 (AWM module) |
Affected:
All versions < V11.36
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:28.434Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Climatix POL909 (AWB module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.44"
}
]
},
{
"product": "Climatix POL909 (AWM module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.36"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T11:31:09.000Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-41541",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Climatix POL909 (AWB module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.44"
}
]
}
},
{
"product_name": "Climatix POL909 (AWM module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.36"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The Group Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-41541",
"datePublished": "2022-03-08T11:31:09.000Z",
"dateReserved": "2021-09-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:28.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41542 (GCVE-0-2021-41542)
Vulnerability from cvelistv5 – Published: 2022-03-08 11:31 – Updated: 2024-08-04 03:15
VLAI
EPSS
Summary
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action.
Severity
No CVSS data available.
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | Climatix POL909 (AWB module) |
Affected:
All versions < V11.44
|
|
| Siemens | Climatix POL909 (AWM module) |
Affected:
All versions < V11.36
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:28.699Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Climatix POL909 (AWB module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.44"
}
]
},
{
"product": "Climatix POL909 (AWM module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.36"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T11:31:11.000Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-41542",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Climatix POL909 (AWB module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.44"
}
]
}
},
{
"product_name": "Climatix POL909 (AWM module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.36"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The User Management page of affected devices is vulnerable to cross-site scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user\u0027s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-41542",
"datePublished": "2022-03-08T11:31:11.000Z",
"dateReserved": "2021-09-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:28.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41543 (GCVE-0-2021-41543)
Vulnerability from cvelistv5 – Published: 2022-03-08 11:31 – Updated: 2024-08-04 03:15
VLAI
EPSS
Summary
A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files.
Severity
No CVSS data available.
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/s… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | Climatix POL909 (AWB module) |
Affected:
All versions < V11.44
|
|
| Siemens | Climatix POL909 (AWM module) |
Affected:
All versions < V11.36
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:15:28.650Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Climatix POL909 (AWB module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.44"
}
]
},
{
"product": "Climatix POL909 (AWM module)",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V11.36"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-08T11:31:12.000Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-41543",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Climatix POL909 (AWB module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.44"
}
]
}
},
{
"product_name": "Climatix POL909 (AWM module)",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V11.36"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \u003c V11.44), Climatix POL909 (AWM module) (All versions \u003c V11.36). The handling of log files in the web application of affected devices contains an information disclosure vulnerability which could allow logged in users to access sensitive files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284: Improper Access Control"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-252466.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-41543",
"datePublished": "2022-03-08T11:31:12.000Z",
"dateReserved": "2021-09-21T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:15:28.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42016 (GCVE-0-2021-42016)
Vulnerability from cvelistv5 – Published: 2022-03-08 11:31 – Updated: 2025-08-12 11:10
VLAI
EPSS
Summary
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A timing attack, in a third-party component, could make the retrieval of the private key possible, used for encryption of sensitive data.
If a threat actor were to exploit this, the data integrity and security could be compromised.
Severity
CWE
- CWE-208 - Observable Timing Discrepancy
Assigner
References
Impacted products
90 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | RUGGEDCOM i800 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM i801 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM i802 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM i803 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M2100 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M2100F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM M2200 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M2200F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM M969 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M969F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RMC30 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RMC8388 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RMC8388 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RP110 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS1600 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS1600F |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS1600T |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS400 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS400F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS401 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS416P |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416PF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS416Pv2 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416Pv2 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS416v2 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416v2 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS8000 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS8000A |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS8000H |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS8000T |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900 (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900 (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS900F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS900G |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900G (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900G (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS900GF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS900GP |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900GPF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS900L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-GETS-C01 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-GETS-XX |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-STND-C01 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-STND-XX |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS910 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS910L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS910W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS920L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS920W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS930L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS930W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS940G |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS940GF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS969 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100 (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100 (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100P |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100P (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100P (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100PF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2200 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2200F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2288 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2288 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300P V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300P V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300PF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2488 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2488 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2488F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG907R |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG908C |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG909R |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG910C |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG920P V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG920P V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSL910 |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST2228 |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST2228P |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST916C |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST916P |
Affected:
0 , < V5.6.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:22:25.784Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i800",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i801",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i802",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i803",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2100",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2100F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2200F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M969",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M969F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RMC30",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RMC8388 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RMC8388 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RP110",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS1600",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS1600F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS1600T",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS400",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS400F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS401",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416PF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416Pv2 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416Pv2 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416v2 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416v2 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000A",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000H",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000T",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900 (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900 (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900G",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900G (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900G (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900GF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900GP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900GPF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-GETS-C01",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-GETS-XX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-STND-C01",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-STND-XX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS910",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS910L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS910W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS920L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS920W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS930L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS930W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS940G",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS940GF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS969",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100 (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100 (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100P (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100P (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100PF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2200F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2288 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2288 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300P V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300P V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300PF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2488 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2488 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2488F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG907R",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG908C",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG909R",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG910C",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG920P V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG920P V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSL910",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2228",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2228P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST916C",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST916P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A timing attack, in a third-party component, could make the retrieval of the private key possible, used for encryption of sensitive data. \r\n\r\nIf a threat actor were to exploit this, the data integrity and security could be compromised."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-208",
"description": "CWE-208: Observable Timing Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T11:10:54.707Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-256353.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-42016",
"datePublished": "2022-03-08T11:31:14.000Z",
"dateReserved": "2021-10-06T00:00:00.000Z",
"dateUpdated": "2025-08-12T11:10:54.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42017 (GCVE-0-2021-42017)
Vulnerability from cvelistv5 – Published: 2022-03-08 11:31 – Updated: 2025-08-12 11:10
VLAI
EPSS
Summary
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2.
If an attacker were to exploit this, they could act as a man-in-the-middle and eavesdrop on encrypted communications.
Severity
CWE
- CWE-358 - Improperly Implemented Security Check for Standard
Assigner
References
Impacted products
90 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | RUGGEDCOM i800 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM i801 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM i802 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM i803 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M2100 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M2100F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM M2200 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M2200F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM M969 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM M969F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RMC30 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RMC8388 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RMC8388 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RP110 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS1600 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS1600F |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS1600T |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS400 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS400F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS401 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS416P |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416PF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS416Pv2 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416Pv2 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS416v2 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS416v2 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS8000 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS8000A |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS8000H |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS8000T |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900 (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900 (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS900F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS900G |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900G (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900G (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RS900GF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS900GP |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900GPF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS900L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-GETS-C01 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-GETS-XX |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-STND-C01 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900M-STND-XX |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS900W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS910 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS910L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS910W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS920L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS920W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS930L |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS930W |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS940G |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RS940GF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RS969 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100 (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100 (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100P |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100P (32M) V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100P (32M) V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2100PF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2200 |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2200F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2288 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2288 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300P V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300P V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2300PF |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG2488 V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG2488 V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG2488F |
Affected:
0 , < *
(custom)
|
|
| Siemens | RUGGEDCOM RSG907R |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG908C |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG909R |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG910C |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSG920P V4.X |
Affected:
0 , < V4.3.8
(custom)
|
|
| Siemens | RUGGEDCOM RSG920P V5.X |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RSL910 |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST2228 |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST2228P |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST916C |
Affected:
0 , < V5.6.0
(custom)
|
|
| Siemens | RUGGEDCOM RST916P |
Affected:
0 , < V5.6.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:22:25.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i800",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i801",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i802",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM i803",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2100",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2100F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M2200F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M969",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM M969F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RMC30",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RMC8388 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RMC8388 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RP110",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS1600",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS1600F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS1600T",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS400",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS400F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS401",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416PF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416Pv2 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416Pv2 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416v2 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS416v2 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000A",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000H",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS8000T",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900 (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900 (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900G",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900G (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900G (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900GF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900GP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900GPF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-GETS-C01",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-GETS-XX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-STND-C01",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900M-STND-XX",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS900W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS910",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS910L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS910W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS920L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS920W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS930L",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS930W",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS940G",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS940GF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RS969",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100 (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100 (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100P (32M) V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100P (32M) V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2100PF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2200",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2200F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2288 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2288 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300P V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300P V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2300PF",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2488 V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2488 V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG2488F",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG907R",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG908C",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG909R",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG910C",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG920P V4.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSG920P V5.X",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RSL910",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2228",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2228P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST916C",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST916P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V5.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2.\r\n\r\nIf an attacker were to exploit this, they could act as a man-in-the-middle and eavesdrop on encrypted communications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-358",
"description": "CWE-358: Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T11:10:57.876Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-256353.pdf"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-256353.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-42017",
"datePublished": "2022-03-08T11:31:15.000Z",
"dateReserved": "2021-10-06T00:00:00.000Z",
"dateUpdated": "2025-08-12T11:10:57.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…