Siemens RUGGEDCOM APE180
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC before V22.6.2. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available. Customers are advised to consult and implement the workarounds provided in Nozomi Network's upstream security notifications.
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-24015US | medium4.3 | — | ||
A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null.
The rep… | ||||
| CVE-2023-23903US | medium4.9 | — | ||
An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application r… | ||||
| CVE-2023-24471US | medium6.5OT elevated | — | ||
An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.
An authenticated user wit… | ||||
| CVE-2023-23574US | high8.8 | — | ||
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute… | ||||
| CVE-2023-22843US | medium4.8 | — | ||
An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that… | ||||
| CVE-2023-22378US | medium6.5 | — | ||
A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbi… | ||||
| CVE-2023-24477US | high7.0 | — | ||
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon lo… | ||||
references
External citations — patches, advisories, analysis.
- SSA-647455: Multiple Vulnerabilities in Nozomi Guardian/CMC before 22.6.2 on RUGGEDCOM APE1808 devices - CSAF Versionself
- SSA-647455: Multiple Vulnerabilities in Nozomi Guardian/CMC before 22.6.2 on RUGGEDCOM APE1808 devices - HTML Versionself
- SSA-647455: Multiple Vulnerabilities in Nozomi Guardian/CMC before 22.6.2 on RUGGEDCOM APE1808 devices - PDF Versionself
- SSA-647455: Multiple Vulnerabilities in Nozomi Guardian/CMC before 22.6.2 on RUGGEDCOM APE1808 devices - TXT Versionself
- ICS Advisory ICSA-23-285-07 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-285-07 - Web Versionself
- Recommended Practicesexternal
remediations (14)
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- FixedRUGGEDCOM APE1808
Upgrade Nozomi Guardian / CMC to V23.4.1. Contact customer support to receive patch and update information.
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
- WorkaroundRUGGEDCOM APE1808
Adopt best practices that include closing the browser after a logout
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan