Vulnerability-Lookup

BDU:2024-05388

Vulnerability from fstec - Published: 12.06.2024

Title

Уязвимость функции переадресации IP-пакетов IP-Forwarding микропрограммного обеспечения Ethernet-коммутаторов RUGGEDCOM, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Description

Уязвимость функции переадресации IP-пакетов IP-Forwarding микропрограммного обеспечения Ethernet-коммутаторов RUGGEDCOM связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации

Severity ?


                    
                      AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Vendor

Siemens AG

Software Name

RUGGEDCOM RMC8388, RUGGEDCOM RMC8388NC, RUGGEDCOM RS416NCv2, RUGGEDCOM RS416PNCv2, RUGGEDCOM RS900GNC(32M), RUGGEDCOM RS900NC(32M), RUGGEDCOM RSG2100NC(32M), RUGGEDCOM RSG2288NC, RUGGEDCOM RSG2300NC, RUGGEDCOM RSG2300PNC, RUGGEDCOM RSG2488NC, RUGGEDCOM RSG920PNC, RUGGEDCOM RSL910NC, RUGGEDCOM RST916P, RUGGEDCOM RST916C, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RSL910, RUGGEDCOM RSG910C, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RS416Pv2, RUGGEDCOM RSG2488, RUGGEDCOM RSG2300P, RUGGEDCOM RSG920P, RUGGEDCOM RSG2300, RUGGEDCOM RSG2288, RUGGEDCOM RSG2100 (32M), RUGGEDCOM RS900G (32M), RUGGEDCOM RS900 (32M), RUGGEDCOM RS416v2

Software Version

от 5.0.0 до 5.9.0 (RUGGEDCOM RMC8388), от 5.0.0 до 5.9.0 (RUGGEDCOM RMC8388NC), от 5.0.0 до 5.9.0 (RUGGEDCOM RS416NCv2), от 5.0.0 до 5.9.0 (RUGGEDCOM RS416PNCv2), от 5.0.0 до 5.9.0 (RUGGEDCOM RS900GNC(32M)), от 5.0.0 до 5.9.0 (RUGGEDCOM RS900NC(32M)), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2100NC(32M)), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2288NC), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2300NC), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2300PNC), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2488NC), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG920PNC), до 5.9.0 (RUGGEDCOM RSL910NC), до 5.9.0 (RUGGEDCOM RST916P), до 5.9.0 (RUGGEDCOM RST916C), до 5.9.0 (RUGGEDCOM RST2228), до 5.9.0 (RUGGEDCOM RST2228P), до 5.9.0 (RUGGEDCOM RSL910), до 5.9.0 (RUGGEDCOM RSG910C), до 5.9.0 (RUGGEDCOM RSG907R), до 5.9.0 (RUGGEDCOM RSG908C), до 5.9.0 (RUGGEDCOM RSG909R), от 5.0.0 до 5.9.0 (RUGGEDCOM RS416Pv2), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2488), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2300P), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG920P), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2300), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2288), от 5.0.0 до 5.9.0 (RUGGEDCOM RSG2100 (32M)), от 5.0.0 до 5.9.0 (RUGGEDCOM RS900G (32M)), от 5.0.0 до 5.9.0 (RUGGEDCOM RS900 (32M)), от 5.0.0 до 5.9.0 (RUGGEDCOM RS416v2)

Possible Mitigations

Использование рекомендаций: https://cert-portal.siemens.com/productcert/html/ssa-170375.html Компенсирующие меры: В случае невозможности установки обновлений рекомендуется отключить функцию переадресации IP-пакетов IP-Forwarding, если она не требуется (обратите внимание, что функция IP-Forwarding по умолчанию отключена).

Reference

https://cert-portal.siemens.com/productcert/html/ssa-170375.html https://www.cisa.gov/news-events/ics-advisories/icsa-15-244-01 https://vuldb.com/?id.270664

CWE

CWE-266

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:M/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Siemens AG",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RMC8388), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RMC8388NC), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS416NCv2), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS416PNCv2), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS900GNC(32M)), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS900NC(32M)), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2100NC(32M)), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2288NC), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2300NC), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2300PNC), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2488NC), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG920PNC), \u0434\u043e 5.9.0 (RUGGEDCOM RSL910NC), \u0434\u043e 5.9.0 (RUGGEDCOM RST916P), \u0434\u043e 5.9.0 (RUGGEDCOM RST916C), \u0434\u043e 5.9.0 (RUGGEDCOM RST2228), \u0434\u043e 5.9.0 (RUGGEDCOM RST2228P), \u0434\u043e 5.9.0 (RUGGEDCOM RSL910), \u0434\u043e 5.9.0 (RUGGEDCOM RSG910C), \u0434\u043e 5.9.0 (RUGGEDCOM RSG907R), \u0434\u043e 5.9.0 (RUGGEDCOM RSG908C), \u0434\u043e 5.9.0 (RUGGEDCOM RSG909R), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS416Pv2), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2488), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2300P), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG920P), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2300), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2288), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RSG2100 (32M)), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS900G (32M)), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS900 (32M)), \u043e\u0442 5.0.0 \u0434\u043e 5.9.0 (RUGGEDCOM RS416v2)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://cert-portal.siemens.com/productcert/html/ssa-170375.html\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u043f\u0435\u0440\u0435\u0430\u0434\u0440\u0435\u0441\u0430\u0446\u0438\u0438 IP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 IP-Forwarding, \u0435\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f (\u043e\u0431\u0440\u0430\u0442\u0438\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u0447\u0442\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u044f IP-Forwarding \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0430).",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.06.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.07.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "19.07.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-05388",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-38278, SSA-170375, ICSA-15-244-01",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "RUGGEDCOM RMC8388, RUGGEDCOM RMC8388NC, RUGGEDCOM RS416NCv2, RUGGEDCOM RS416PNCv2, RUGGEDCOM RS900GNC(32M), RUGGEDCOM RS900NC(32M), RUGGEDCOM RSG2100NC(32M), RUGGEDCOM RSG2288NC, RUGGEDCOM RSG2300NC, RUGGEDCOM RSG2300PNC, RUGGEDCOM RSG2488NC, RUGGEDCOM RSG920PNC, RUGGEDCOM RSL910NC, RUGGEDCOM RST916P, RUGGEDCOM RST916C, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RSL910, RUGGEDCOM RSG910C, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RS416Pv2, RUGGEDCOM RSG2488, RUGGEDCOM RSG2300P, RUGGEDCOM RSG920P, RUGGEDCOM RSG2300, RUGGEDCOM RSG2288, RUGGEDCOM RSG2100 (32M), RUGGEDCOM RS900G (32M), RUGGEDCOM RS900 (32M), RUGGEDCOM RS416v2",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0430\u0434\u0440\u0435\u0441\u0430\u0446\u0438\u0438 IP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 IP-Forwarding \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Ethernet-\u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 RUGGEDCOM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (CWE-266)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0430\u0434\u0440\u0435\u0441\u0430\u0446\u0438\u0438 IP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 IP-Forwarding \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Ethernet-\u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 RUGGEDCOM \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://cert-portal.siemens.com/productcert/html/ssa-170375.html\nhttps://www.cisa.gov/news-events/ics-advisories/icsa-15-244-01\nhttps://vuldb.com/?id.270664",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-266",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,6)"
}

ICSA-15-244-01

Vulnerability from csaf_cisa - Published: 2015-06-04 06:00 - Updated: 2025-06-06 16:10

Summary

Siemens RUGGEDCOM ROS IP Forwarding Vulnerability

Notes

Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

CISA Disclaimer: This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Recommended Practices: CISA recommends users take defensive measures to minimize the risk of exploitation.

Recommended Practices: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Recommended Practices: Locate control system networks and remote devices behind firewalls and isolating them from business networks.

Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Recommended Practices: CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

CVE-2015-6675

4.3 ()


                        
                          AV:A/AC:M/Au:N/C:P/I:P/A:N

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

Mitigation Firmware versions since ROS 4.2.0 provide an option to disable IP forwarding. Siemens recommends that users update to the latest firmware version. The firmware updates for the affected products can be obtained for free from the following contact points: Submit a support request online: (http://www.siemens.com/automation/support-request) http://www.siemens.com/automation/support-request

Mitigation Call a local hotline center: (http://www.automation.siemens.com/mcms/aspa-db/en/automationtechnology/Pages/default.aspx) http://www.automation.siemens.com/mcms/aspa-db/en…

Mitigation If users do not want IP forwarding between VLANs in their configuration, then they need to disable IP forwarding after updating to the new firmware according to the instructions in the user guide. The following link leads to the ROS user guide: (https://support.industry.siemens.com/cs/ww/en/ps/15305/man) Until the firmware can be updated to the latest version, users can remove IP addresses from the VLAN if they are not required. https://support.industry.siemens.com/cs/ww/en/ps/…

Mitigation For more information on this vulnerability and detailed instructions, please see Siemens Security Advisory SSA-720081 at the following location: (https://cert-portal.siemens.com/productcert/pdf/ssa-720081.pdf) https://cert-portal.siemens.com/productcert/pdf/s…

References

URL

Category

	https://raw.githubusercontent.com/cisagov/CSAF/de…	self
	https://www.cisa.gov/news-events/ics-advisories/i…	self
	https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-…	external
	https://www.cisa.gov/resources-tools/resources/ic…	external
	https://www.cisa.gov/topics/industrial-control-systems	external
	https://us-cert.cisa.gov/sites/default/files/reco…	external
	https://www.cisa.gov/sites/default/files/publicat…	external
	https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B	external
	https://www.cisa.gov/uscert/sites/default/files/p…	external
	https://www.cisa.gov/uscert/ncas/tips/ST04-014	external

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-15-244-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2015/icsa-15-244-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-15-244-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-244-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      }
    ],
    "title": "Siemens RUGGEDCOM ROS IP Forwarding Vulnerability",
    "tracking": {
      "current_release_date": "2025-06-06T16:10:32.525653Z",
      "generator": {
        "date": "2025-06-06T16:10:32.525549Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-15-244-01",
      "initial_release_date": "2015-06-04T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2015-06-04T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        },
        {
          "date": "2025-06-06T16:10:32.525653Z",
          "legacy_version": "CSAF Conversion",
          "number": "2",
          "summary": "Advisory converted into a CSAF"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=3.8.0|\u003c=4.2.0",
                "product": {
                  "name": "Siemens ROS: \u003e=3.8.0|\u003c=4.2.0",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ROS"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-6675",
      "cwe": {
        "id": "CWE-441",
        "name": "Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffic.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Firmware versions since ROS 4.2.0 provide an option to disable IP forwarding. Siemens recommends that users update to the latest firmware version. The firmware updates for the affected products can be obtained for free from the following contact points: Submit a support request online: (http://www.siemens.com/automation/support-request)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.siemens.com/automation/support-request"
        },
        {
          "category": "mitigation",
          "details": "Call a local hotline center: (http://www.automation.siemens.com/mcms/aspa-db/en/automationtechnology/Pages/default.aspx)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.automation.siemens.com/mcms/aspa-db/en/automationtechnology/Pages/default.aspx"
        },
        {
          "category": "mitigation",
          "details": "If users do not want IP forwarding between VLANs in their configuration, then they need to disable IP forwarding after updating to the new firmware according to the instructions in the user guide. The following link leads to the ROS user guide:  (https://support.industry.siemens.com/cs/ww/en/ps/15305/man)  Until the firmware can be updated to the latest version, users can remove IP addresses from the VLAN if they are not required.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/ps/15305/man"
        },
        {
          "category": "mitigation",
          "details": "For more information on this vulnerability and detailed instructions, please see Siemens Security Advisory SSA-720081 at the following location: (https://cert-portal.siemens.com/productcert/pdf/ssa-720081.pdf)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-720081.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "baseScore": 4.3,
            "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2024-05388

ICSA-15-244-01

Tags

Sightings

Nomenclature