High severity · published Dec 26, 2017
CVE-2017-12736
After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions.
This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RR
Ruggedcom Ros · Siemens
before 5.0.1; before 4.3.4 · source: NVD
SX
Scalance Xb-200 Firmware · Siemens
3.0 and later · source: NVD
SX
Scalance Xc-200 Firmware · Siemens
3.0 and later · source: NVD
SX
Scalance Xm-400 Firmware · Siemens
6.1 and later · source: NVD
SX
Scalance Xp-200 Firmware · Siemens
3.0 and later · source: NVD
SX
Scalance Xr-500 Firmware · Siemens
6.1 and later · source: NVD
SX
Scalance Xr300-wg Firmware · Siemens
3.0 and later · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12736
Third Party Advisory
http://www.securityfocus.com/bid/101041
Third Party Advisory
http://www.securitytracker.com/id/1039463
Third Party Advisory
http://www.securitytracker.com/id/1039464
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-856721.html
Issue Tracking
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856721.pdf
More from Ruggedcom Ros
9.8
CVE-2023-24845
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
9.6
CVE-2021-37208
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
8.0
CVE-2022-34663
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
7.5
CVE-2023-39269
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…
7.5
CVE-2021-42020
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC,…