#VU78321 Command Injection in Siemens products - CVE-2023-36754

Vulnerability identifier: #VU78321

Vulnerability risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-36754

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
RUGGEDCOM ROX MX5000
Hardware solutions / Firmware
RUGGEDCOM ROX MX5000RE
Hardware solutions / Firmware
RUGGEDCOM ROX RX1400
Hardware solutions / Firmware
RUGGEDCOM ROX RX1500
Hardware solutions / Firmware
RUGGEDCOM ROX RX1501
Hardware solutions / Firmware
RUGGEDCOM ROX RX1510
Hardware solutions / Firmware
RUGGEDCOM ROX RX1511
Hardware solutions / Firmware
RUGGEDCOM ROX RX1512
Hardware solutions / Firmware
RUGGEDCOM ROX RX1524
Hardware solutions / Firmware
RUGGEDCOM ROX RX1536
Hardware solutions / Firmware
RUGGEDCOM ROX RX5000
Hardware solutions / Firmware

Vendor: Siemens

Description

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation within the SCEP server configuration URL parameter in the web interface. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

RUGGEDCOM ROX MX5000: before 2.16.0

RUGGEDCOM ROX MX5000RE: before 2.16.0

RUGGEDCOM ROX RX1400: before 2.16.0

RUGGEDCOM ROX RX1500: before 2.16.0

RUGGEDCOM ROX RX1501: before 2.16.0

RUGGEDCOM ROX RX1510: before 2.16.0

RUGGEDCOM ROX RX1511: before 2.16.0

RUGGEDCOM ROX RX1512: before 2.16.0

RUGGEDCOM ROX RX1524: before 2.16.0

RUGGEDCOM ROX RX1536: before 2.16.0

RUGGEDCOM ROX RX5000: before 2.16.0

---

External links
https://cert-portal.siemens.com/productcert/txt/ssa-146325.txt

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.