Sign-up

ID

VAR-201703-0645


CVE

CVE-2017-2688


TITLE

Siemens RUGGEDCOM ROX I Port 10000/TCP Integration Web Server cross-site request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-002722

DESCRIPTION

The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with the privileges of an authenticated user, provided the targeted user has an active session and is induced into clicking on a malicious link or into visiting a malicious website, aka CSRF. SiemensRuggedCom's ROX-based firewall devices are used to connect devices in harsh environments such as substations, traffic management chassis, and more. SiemensRUGGEDCOMROXI has a privilege escalation vulnerability. Siemens RUGGEDCOM ROX I is prone to the following security vulnerabilities: : 1. A cross-site request-forgery vulnerability An attacker may leverage these issues to execute HTML and script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, perform certain unauthorized actions actions, gain unauthorized access, or bypass certain security restrictions

Trust: 2.61

sources: NVD: CVE-2017-2688 // JVNDB: JVNDB-2017-002722 // CNVD: CNVD-2017-03653 // BID: 97170 // IVD: 765113ba-809a-44f3-be23-cb4be3b08038

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 765113ba-809a-44f3-be23-cb4be3b08038 // CNVD: CNVD-2017-03653

AFFECTED PRODUCTS

vendor:siemensmodel:ruggedcom rox iscope:lteversion:2.9.0

Trust: 1.0

vendor:siemensmodel:ruggedcom rox iscope:eqversion: -

Trust: 0.8

vendor:siemensmodel:ruggedcom rox iscope: - version: -

Trust: 0.6

vendor:siemensmodel:ruggedcom rox iscope:eqversion:2.9.0

Trust: 0.6

vendor:siemensmodel:ruggedcom rox iscope:eqversion:0

Trust: 0.3

vendor:ruggedcom rox imodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 765113ba-809a-44f3-be23-cb4be3b08038 // CNVD: CNVD-2017-03653 // BID: 97170 // JVNDB: JVNDB-2017-002722 // CNNVD: CNNVD-201703-1333 // NVD: CVE-2017-2688

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2688
value: HIGH

Trust: 1.0

NVD: CVE-2017-2688
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-03653
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201703-1333
value: MEDIUM

Trust: 0.6

IVD: 765113ba-809a-44f3-be23-cb4be3b08038
value: MEDIUM

Trust: 0.2

nvd@nist.gov: CVE-2017-2688
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-03653
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:N/C:P/I:C/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 765113ba-809a-44f3-be23-cb4be3b08038
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:N/C:P/I:C/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-2688
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 765113ba-809a-44f3-be23-cb4be3b08038 // CNVD: CNVD-2017-03653 // JVNDB: JVNDB-2017-002722 // CNNVD: CNNVD-201703-1333 // NVD: CVE-2017-2688

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.8

sources: JVNDB: JVNDB-2017-002722 // NVD: CVE-2017-2688

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-1333

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201703-1333

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002722

PATCH
title:SSA-327980url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf
Trust: 0.8
title:SiemensRUGGEDCOMROXI privilege escalation vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/91177
Trust: 0.6
title:Siemens RUGGEDCOM ROX I Fixes for cross-site request forgery vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68861
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-03653 // 
            
            
            
            JVNDB: JVNDB-2017-002722 // 
            
            
            
            CNNVD: CNNVD-201703-1333

EXTERNAL IDS
db:NVDid:CVE-2017-2688
Trust: 3.5
db:SIEMENSid:SSA-327980
Trust: 2.5
db:ICS CERTid:ICSA-17-087-01
Trust: 1.3
db:BIDid:97170
Trust: 1.3
db:SECTRACKid:1038160
Trust: 1.0
db:CNVDid:CNVD-2017-03653
Trust: 0.8
db:CNNVDid:CNNVD-201703-1333
Trust: 0.8
db:JVNDBid:JVNDB-2017-002722
Trust: 0.8
db:IVDid:765113BA-809A-44F3-BE23-CB4BE3B08038
Trust: 0.2
sources:
            
            
            IVD: 765113ba-809a-44f3-be23-cb4be3b08038 // 
            
            
            
            CNVD: CNVD-2017-03653 // 
            
            
            
            BID: 97170 // 
            
            
            
            JVNDB: JVNDB-2017-002722 // 
            
            
            
            CNNVD: CNNVD-201703-1333 // 
            
            
            
            NVD: CVE-2017-2688

REFERENCES
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf
Trust: 2.5
url:https://ics-cert.us-cert.gov/advisories/icsa-17-087-01
Trust: 1.3
url:http://www.securityfocus.com/bid/97170
Trust: 1.0
url:http://www.securitytracker.com/id/1038160
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2688
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2688
Trust: 0.8
url:http://subscriber.communications.siemens.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-03653 // 
            
            
            
            BID: 97170 // 
            
            
            
            JVNDB: JVNDB-2017-002722 // 
            
            
            
            CNNVD: CNNVD-201703-1333 // 
            
            
            
            NVD: CVE-2017-2688

CREDITS
Maxim Rupp
Trust: 0.3
sources:
            
            
            BID: 97170

SOURCES
db:IVDid:765113ba-809a-44f3-be23-cb4be3b08038
db:CNVDid:CNVD-2017-03653
db:BIDid:97170
db:JVNDBid:JVNDB-2017-002722
db:CNNVDid:CNNVD-201703-1333
db:NVDid:CVE-2017-2688

LAST UPDATE DATE
2025-04-20T23:20:05.256000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-03653date:2017-03-29T00:00:00
db:BIDid:97170date:2017-03-28T00:00:00
db:JVNDBid:JVNDB-2017-002722date:2017-04-26T00:00:00
db:CNNVDid:CNNVD-201703-1333date:2017-03-30T00:00:00
db:NVDid:CVE-2017-2688date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:765113ba-809a-44f3-be23-cb4be3b08038date:2017-03-29T00:00:00
db:CNVDid:CNVD-2017-03653date:2017-03-29T00:00:00
db:BIDid:97170date:2017-03-28T00:00:00
db:JVNDBid:JVNDB-2017-002722date:2017-04-26T00:00:00
db:CNNVDid:CNNVD-201703-1333date:2017-03-30T00:00:00
db:NVDid:CVE-2017-2688date:2017-03-29T01:59:01.783