SSA-384652: Cross-Site Request Forgery (CSRF) Vulnerability in RUGGEDCOM ROX II
The CLI feature in the web interface of RUGGEDCOM ROX II devices is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform administrative actions if an authenticated user is tricked into accessing a malicious link. Siemens has released new versions for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-28398US | — | — | ||
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0)… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (22)
- MitigationRUGGEDCOM ROX MX5000
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX MX5000RE
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1400
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1500
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1501
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1510
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1511
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1512
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1524
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX1536
Only access links from trusted sources while authenticated in web interface of the affected devices
- MitigationRUGGEDCOM ROX RX5000
Only access links from trusted sources while authenticated in web interface of the affected devices
- BehobenRUGGEDCOM ROX MX5000
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX MX5000RE
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1400
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1500
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1501
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1510
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1511
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1512
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1524
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX1536
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/ - BehobenRUGGEDCOM ROX RX5000
Update to V2.16.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109821187/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan