SB2021091703 - Multiple vulnerabilities in Siemens RUGGEDCOM ROX

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2021-37173)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Secure Shell (SSH). A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

2) Execution with unnecessary privileges (CVE-ID: CVE-2021-37174)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application binary has a setuid bit. A remote authenticated attacker can run the affected binary and execute arbitrary code on the system with root privileges.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-37175)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the affected devices do not properly handle permissions to traverse the file system. A remote authenticated attacker can gain access to an overview of the overview of the complete file system on the affected devices.

Remediation

Install update from vendor's website.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-150692.pdf