CVE-2023-36749

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0),…

High7.4EPSS 0.29%

Published: 11 Jul 2023
Updated: 27 Nov 2024
Reserved: 27 Jun 2023
Assigned by: siemens

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The webserver of the affected devices support insecure TLS 1.0 protocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data.

Scores

CVSS scores of CVE-2023-36749, by who scored it
Scored by	CVSS	Score	Vector
siemensCNA (assigner)	3.1	High7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
NVDNVD · Modified	3.1	High7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS (exploitation in 30 days): 0.29% · top 78% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Weakness

CWE-327: Use of a Broken or Risky Cryptographic Algorithm (opens in a new tab)All about CWE-327 and its CVEs

Affected products

Siemens · RUGGEDCOM ROX MX5000
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX MX5000RE
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1400
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1500
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1501
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1510
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1511
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1512
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1524
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX1536
- affected All versions < V2.16.0
Siemens · RUGGEDCOM ROX RX5000
- affected All versions < V2.16.0

References (1)

https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-36749](https://trackcve.app/badge/CVE-2023-36749.svg)](https://trackcve.app/cve/CVE-2023-36749)

Record last updated 27 Nov 2024, 14:15 UTC.