Severity
High
Analysis Summary
CVE-2021-37209
Siemens RUGGEDCOM ROS devices could allow a remote attacker to obtain sensitive information, caused by unencrypted storage of passwords in the client configuration files and network transmission. A remote attacker could exploit this vulnerability to obtain access passwords and use this information to launch further attacks against the affected system.
CVE-2021-42020
Siemens RUGGEDCOM ROS devices are vulnerable to a denial of service, caused by failing to check for null terminations in file names in TFTP functionality. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVE-2021-42019
Siemens RUGGEDCOM ROS devices could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow. By sending a specially crafted request, an attacker could overflow a buffer and execute arbitrary code on the system or cause the system to crash.
CVE-2021-42018
Siemens RUGGEDCOM ROS devices are vulnerable a heap-based buffer overflow, caused by improper bounds checking. By sending a specially crafted request, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVE-2022-26317
Siemens Mendix Studio Pro could allow a remote authenticated attacker to obtain sensitive information, caused by improper user verification for the results of Microflow execution call. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain information about arbitrary Microflow execution calls, and use this information to launch further attacks against the affected system.
CVE-2022-26314
Siemens Mendix Forgot Password Appstore module could allow a remote attacker to obtain sensitive information, caused by an issue with initial passwords are generated in an insecure manner. By utilize brute force attack techniques, an attacker could exploit this vulnerability to obtain passwords information, and use this information to launch further attacks against the affected system.
CVE-2022-26313
Siemens Mendix Forgot Password Appstore module could allow a remote attacker to bypass security restrictions, caused by a flaw in the sign up flow. By sending a specially crafted request, an attacker could exploit this vulnerability to hijack arbitrary user accounts.
Impact
- Information Disclosure
- Denial of Service
- Unauthorized Access
- Buffer Overflow
Indicators Of Compromise
CVE
- CVE-2021-37209
- CVE-2021-42020
- CVE-2021-42019
- CVE-2021-42018
- CVE-2022-26317
- CVE-2022-26314
- CVE-2022-26313
Affected Vendors
Siemens
Affected Products
- Siemens Climatix POL909 AWM
- Siemens RUGGEDCOM ROS M2100
- Siemens RUGGEDCOM ROS RMC8388
- Siemens RUGGEDCOM ROS RS416v2
- Siemens RUGGEDCOM ROS RS900G
- Siemens Mendix Studio Pro 7.23
- Siemens Mendix Forgot Password Appstore module 3.2
- Siemens Mendix Forgot Password Appstore module 3.3.0
- Siemens Mendix Forgot Password Appstore module 3.5.0
Remediation
Refer to Siemens Security Advisory for patch, upgrade, or suggested workaround information.