SSA-384652: Cross-Site Request Forgery (CSRF) Vulnerability in RUGGEDCOM ROX II
The CLI feature in the web interface of RUGGEDCOM ROX II devices is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform administrative actions if an authenticated user is tricked into accessing a malicious link. Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-28398US | — | — | ||
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0)… | ||||
references
External citations — patches, advisories, analysis.
remediations (22)
- MitigationRUGGEDCOM ROX MX5000
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX MX5000RE
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1400
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1500
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1501
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1510
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1511
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1512
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1524
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1536
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX5000
Only access links from trusted sources while authenticated in web interface of the affected devices
- FixedRUGGEDCOM ROX MX5000
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX MX5000RE
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1400
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1500
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1501
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1510
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1511
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1512
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1524
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX1536
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - FixedRUGGEDCOM ROX RX5000
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan