SSA-320629: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.3
view advisory published 2023-03-14
RUGGEDCOM CROSSBOW before V5.3 contains two vulnerabilities that could allow authenticated remote attackers to access data they are not authorized for, or execute arbitrary database queries via an SQL injection attack. Siemens has released an update for RUGGEDCOM CROSSBOW and recommends to update to the latest version.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-27463US | high8.8 | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form of affected applications is vulnerable to SQL injection. This could allow authen… | ||||
| CVE-2023-27462US | medium4.3OT elevated | — | ||
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for spec… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- FixedRUGGEDCOM CROSSBOW
Update to V5.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813558/ - FixedRUGGEDCOM CROSSBOW
Update to V5.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813558/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan