Sign-up

ID

VAR-201703-0643


CVE

CVE-2017-2686


TITLE

Siemens RUGGEDCOM ROX I Arbitrary File Read Vulnerability

Trust: 0.8

sources: IVD: 242b55be-7069-466c-9f11-289f1d3dd037 // CNVD: CNVD-2017-03652

DESCRIPTION

Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port 10000/TCP and access sensitive information. SiemensRuggedCom's ROX-based firewall devices are used to connect devices in harsh environments such as substations, traffic management chassis, and more. Siemens RUGGEDCOM ROX I is prone to the following security vulnerabilities: : 1. A HTML-injection vulnerability 2. A cross-site scripting vulnerability 3. An information-disclosure vulnerability 4. An authorization-bypass vulnerability 5. A cross-site request-forgery vulnerability An attacker may leverage these issues to execute HTML and script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, perform certain unauthorized actions actions, gain unauthorized access, or bypass certain security restrictions

Trust: 2.61

sources: NVD: CVE-2017-2686 // JVNDB: JVNDB-2017-002720 // CNVD: CNVD-2017-03652 // BID: 97170 // IVD: 242b55be-7069-466c-9f11-289f1d3dd037

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 242b55be-7069-466c-9f11-289f1d3dd037 // CNVD: CNVD-2017-03652

AFFECTED PRODUCTS

vendor:siemensmodel:ruggedcom rox iscope:lteversion:2.9.0

Trust: 1.0

vendor:siemensmodel:ruggedcom rox iscope:eqversion: -

Trust: 0.8

vendor:siemensmodel:ruggedcom rox iscope: - version: -

Trust: 0.6

vendor:siemensmodel:ruggedcom rox iscope:eqversion:2.9.0

Trust: 0.6

vendor:siemensmodel:ruggedcom rox iscope:eqversion:0

Trust: 0.3

vendor:ruggedcom rox imodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 242b55be-7069-466c-9f11-289f1d3dd037 // CNVD: CNVD-2017-03652 // BID: 97170 // JVNDB: JVNDB-2017-002720 // CNNVD: CNNVD-201703-1335 // NVD: CVE-2017-2686

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2686
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-2686
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-03652
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201703-1335
value: MEDIUM

Trust: 0.6

IVD: 242b55be-7069-466c-9f11-289f1d3dd037
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2017-2686
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-03652
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 242b55be-7069-466c-9f11-289f1d3dd037
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-2686
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: IVD: 242b55be-7069-466c-9f11-289f1d3dd037 // CNVD: CNVD-2017-03652 // JVNDB: JVNDB-2017-002720 // CNNVD: CNNVD-201703-1335 // NVD: CVE-2017-2686

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

problemtype:CWE-285

Trust: 1.0

sources: JVNDB: JVNDB-2017-002720 // NVD: CVE-2017-2686

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-1335

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201703-1335

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002720

PATCH
title:SSA-327980url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf
Trust: 0.8
title:SiemensRUGGEDCOMROXI patch for arbitrary file read vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/91179
Trust: 0.6
title:Siemens RUGGEDCOM ROX I Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68863
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-03652 // 
            
            
            
            JVNDB: JVNDB-2017-002720 // 
            
            
            
            CNNVD: CNNVD-201703-1335

EXTERNAL IDS
db:NVDid:CVE-2017-2686
Trust: 3.5
db:SIEMENSid:SSA-327980
Trust: 2.5
db:ICS CERTid:ICSA-17-087-01
Trust: 1.3
db:BIDid:97170
Trust: 1.3
db:SECTRACKid:1038160
Trust: 1.0
db:CNVDid:CNVD-2017-03652
Trust: 0.8
db:CNNVDid:CNNVD-201703-1335
Trust: 0.8
db:JVNDBid:JVNDB-2017-002720
Trust: 0.8
db:IVDid:242B55BE-7069-466C-9F11-289F1D3DD037
Trust: 0.2
sources:
            
            
            IVD: 242b55be-7069-466c-9f11-289f1d3dd037 // 
            
            
            
            CNVD: CNVD-2017-03652 // 
            
            
            
            BID: 97170 // 
            
            
            
            JVNDB: JVNDB-2017-002720 // 
            
            
            
            CNNVD: CNNVD-201703-1335 // 
            
            
            
            NVD: CVE-2017-2686

REFERENCES
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf
Trust: 2.5
url:https://ics-cert.us-cert.gov/advisories/icsa-17-087-01
Trust: 1.3
url:http://www.securityfocus.com/bid/97170
Trust: 1.0
url:http://www.securitytracker.com/id/1038160
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2686
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2686
Trust: 0.8
url:http://subscriber.communications.siemens.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-03652 // 
            
            
            
            BID: 97170 // 
            
            
            
            JVNDB: JVNDB-2017-002720 // 
            
            
            
            CNNVD: CNNVD-201703-1335 // 
            
            
            
            NVD: CVE-2017-2686

CREDITS
Maxim Rupp
Trust: 0.3
sources:
            
            
            BID: 97170

SOURCES
db:IVDid:242b55be-7069-466c-9f11-289f1d3dd037
db:CNVDid:CNVD-2017-03652
db:BIDid:97170
db:JVNDBid:JVNDB-2017-002720
db:CNNVDid:CNNVD-201703-1335
db:NVDid:CVE-2017-2686

LAST UPDATE DATE
2025-04-20T23:20:05.294000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-03652date:2017-03-29T00:00:00
db:BIDid:97170date:2017-03-28T00:00:00
db:JVNDBid:JVNDB-2017-002720date:2017-04-26T00:00:00
db:CNNVDid:CNNVD-201703-1335date:2017-03-30T00:00:00
db:NVDid:CVE-2017-2686date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:242b55be-7069-466c-9f11-289f1d3dd037date:2017-03-29T00:00:00
db:CNVDid:CNVD-2017-03652date:2017-03-29T00:00:00
db:BIDid:97170date:2017-03-28T00:00:00
db:JVNDBid:JVNDB-2017-002720date:2017-04-26T00:00:00
db:CNNVDid:CNNVD-201703-1335date:2017-03-30T00:00:00
db:NVDid:CVE-2017-2686date:2017-03-29T01:59:01.703