CVE-2023-49692

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G)…

High7.2EPSS 0.62%

Published: 12 Dec 2023
Updated: 13 Aug 2024
Reserved: 29 Nov 2023
Assigned by: siemens

Description

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.2.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the parsing of the IPSEC configuration. This could allow malicious local administrators to issue commands on system level after a new connection is established.

Scores

CVSS scores of CVE-2023-49692, by who scored it
Scored by	CVSS	Score	Vector
siemensCNA (assigner)	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
NVDNVD · Modified	3.1	Medium6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.62% · top 50% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Siemens · RUGGEDCOM RM1224 LTE(4G) EU
- affected < V7.2.2
Siemens · RUGGEDCOM RM1224 LTE(4G) NAM
- affected < V7.2.2
Siemens · SCALANCE M804PB
- affected < V7.2.2
Siemens · SCALANCE M812-1 ADSL-Router
- affected < V7.2.2
Siemens · SCALANCE M812-1 ADSL-Router
- affected < V7.2.2
Siemens · SCALANCE M816-1 ADSL-Router
- affected < V7.2.2
Siemens · SCALANCE M816-1 ADSL-Router
- affected < V7.2.2
Siemens · SCALANCE M826-2 SHDSL-Router
- affected < V7.2.2
Siemens · SCALANCE M874-2
- affected < V7.2.2
Siemens · SCALANCE M874-3
- affected < V7.2.2
Siemens · SCALANCE M876-3
- affected < V7.2.2
Siemens · SCALANCE M876-3 (ROK)
- affected < V7.2.2
Siemens · SCALANCE M876-4
- affected < V7.2.2
Siemens · SCALANCE M876-4 (EU)
- affected < V7.2.2
Siemens · SCALANCE M876-4 (NAM)
- affected < V7.2.2
Siemens · SCALANCE MUM853-1 (EU)
- affected < V7.2.2
Siemens · SCALANCE MUM856-1 (EU)
- affected < V7.2.2
Siemens · SCALANCE MUM856-1 (RoW)
- affected < V7.2.2
Siemens · SCALANCE S615 EEC LAN-Router
- affected < V7.2.2
Siemens · SCALANCE S615 LAN-Router
- affected < V7.2.2

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-49692](https://trackcve.app/badge/CVE-2023-49692.svg)](https://trackcve.app/cve/CVE-2023-49692)

Record last updated 13 Aug 2024, 07:53 UTC.