CVE-2017-12736

A vulnerability has been identified in RUGGEDCOM ROS for RSL910 devices (All versions < ROS V5.0.1), RUGGEDCOM ROS for all other devices (All versions < ROS V4.3.4), SCALANCE XB-200/XC-200/XP-200/XR300-WG (All versions between V3.0 (including) and V3.0.2 (excluding)), SCALANCE XR-500/XM-400 (All versions between V6.1 (including) and V6.1.1 (excluding)). After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to writeto the device under certain conditions, potentially allowing users located in the adjacentnetwork of the targeted device to perform unauthorized administrative actions.
References
Link Resource
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856721.pdf Issue Tracking Mitigation Vendor Advisory
http://www.securitytracker.com/id/1039464 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039463 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/101041 Third Party Advisory VDB Entry
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:scalance_xb-200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xb-200:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:scalance_xc-200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xc-200:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:scalance_xp-200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xp-200:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:siemens:scalance_xr300-wg_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xr300-wg:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:siemens:scalance_xr-500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xr-500:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:scalance_xm-400_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xm-400:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_ros:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rsl910:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_ros:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom:-:*:*:*:*:*:*:*

Information

Published : 2017-12-25 20:29

Updated : 2019-10-02 17:03


NVD link : CVE-2017-12736

Mitre link : CVE-2017-12736


JSON object : View

CWE
CWE-665

Improper Initialization

Advertisement

dedicated server usa

Products Affected

siemens

  • scalance_xr-500_firmware
  • scalance_xr-500
  • ruggedcom
  • scalance_xm-400
  • scalance_xc-200_firmware
  • scalance_xb-200
  • ruggedcom_ros
  • scalance_xb-200_firmware
  • scalance_xr300-wg
  • scalance_xp-200
  • scalance_xp-200_firmware
  • ruggedcom_rsl910
  • scalance_xc-200
  • scalance_xr300-wg_firmware
  • scalance_xm-400_firmware