Medium severity · published Dec 12, 2023
CVE-2023-49692
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…
6.7
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.2.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the parsing of the IPSEC configuration. This could allow malicious local administrators to issue commands on system level after a new connection is established.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RR
RUGGEDCOM RM1224 LTE(4G) EU · Siemens
before V7.2.2 · source: vendor
RR
RUGGEDCOM RM1224 LTE(4G) NAM · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M804PB · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M812-1 ADSL-Router · Siemens
before V7.2.2; before V7.2.2 · source: vendor
SM
SCALANCE M816-1 ADSL-Router · Siemens
before V7.2.2; before V7.2.2 · source: vendor
SM
SCALANCE M826-2 SHDSL-Router · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M874-2 · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M874-3 · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M876-3 · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M876-3 (ROK) · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M876-4 · Siemens
before V7.2.2 · source: vendor
SM
SCALANCE M876-4 (EU) · Siemens
before V7.2.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49692
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-068047.html
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-602936.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf
More from RUGGEDCOM RM1224 LTE(4G) EU
9.8
CVE-2024-50557
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…
9.1
CVE-2023-44373
Affected devices do not properly sanitize an input field
9.1
CVE-2022-36323
Affected devices do not properly sanitize an input field
8.8
CVE-2025-15467
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
8.8
CVE-2024-41976
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…