Sign-up

ID

VAR-201703-0646


CVE

CVE-2017-2689


TITLE

Siemens RUGGEDCOM ROX I Security Bypass Vulnerability

Trust: 0.8

sources: IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1 // CNVD: CNVD-2017-03650

DESCRIPTION

Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged file system access or change configuration settings. SiemensRuggedCom's ROX-based firewall devices are used to connect devices in harsh environments such as substations, traffic management chassis, and more. Siemens RUGGEDCOM ROX I is prone to the following security vulnerabilities: : 1. A HTML-injection vulnerability 2. A cross-site scripting vulnerability 3. An information-disclosure vulnerability 4. An authorization-bypass vulnerability 5. A cross-site request-forgery vulnerability An attacker may leverage these issues to execute HTML and script code in the browser of an unsuspecting user in the context of the affected site, disclose sensitive information, perform certain unauthorized actions actions, gain unauthorized access, or bypass certain security restrictions

Trust: 2.61

sources: NVD: CVE-2017-2689 // JVNDB: JVNDB-2017-002723 // CNVD: CNVD-2017-03650 // BID: 97170 // IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1 // CNVD: CNVD-2017-03650

AFFECTED PRODUCTS

vendor:siemensmodel:ruggedcom rox iscope:lteversion:2.9.0

Trust: 1.0

vendor:siemensmodel:ruggedcom rox iscope:eqversion: -

Trust: 0.8

vendor:siemensmodel:ruggedcom rox iscope: - version: -

Trust: 0.6

vendor:siemensmodel:ruggedcom rox iscope:eqversion:2.9.0

Trust: 0.6

vendor:siemensmodel:ruggedcom rox iscope:eqversion:0

Trust: 0.3

vendor:ruggedcom rox imodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1 // CNVD: CNVD-2017-03650 // BID: 97170 // JVNDB: JVNDB-2017-002723 // CNNVD: CNNVD-201703-1332 // NVD: CVE-2017-2689

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2689
value: HIGH

Trust: 1.0

NVD: CVE-2017-2689
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-03650
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201703-1332
value: HIGH

Trust: 0.6

IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2017-2689
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-03650
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2017-2689
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1 // CNVD: CNVD-2017-03650 // JVNDB: JVNDB-2017-002723 // CNNVD: CNNVD-201703-1332 // NVD: CVE-2017-2689

PROBLEMTYPE DATA

problemtype:CWE-285

Trust: 1.0

problemtype:CWE-287

Trust: 1.0

problemtype:CWE-264

Trust: 0.8

sources: JVNDB: JVNDB-2017-002723 // NVD: CVE-2017-2689

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-1332

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201703-1332

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002723

PATCH
title:SSA-327980url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf
Trust: 0.8
title:SiemensRUGGEDCOMROXI security bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/91176
Trust: 0.6
title:Siemens RUGGEDCOM ROX I Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68860
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-03650 // 
            
            
            
            JVNDB: JVNDB-2017-002723 // 
            
            
            
            CNNVD: CNNVD-201703-1332

EXTERNAL IDS
db:NVDid:CVE-2017-2689
Trust: 3.5
db:SIEMENSid:SSA-327980
Trust: 2.5
db:ICS CERTid:ICSA-17-087-01
Trust: 1.9
db:BIDid:97170
Trust: 1.9
db:SECTRACKid:1038160
Trust: 1.6
db:CNVDid:CNVD-2017-03650
Trust: 0.8
db:CNNVDid:CNNVD-201703-1332
Trust: 0.8
db:JVNDBid:JVNDB-2017-002723
Trust: 0.8
db:IVDid:683A6C58-61FD-4FC8-AFA8-1AC889ED64F1
Trust: 0.2
sources:
            
            
            IVD: 683a6c58-61fd-4fc8-afa8-1ac889ed64f1 // 
            
            
            
            CNVD: CNVD-2017-03650 // 
            
            
            
            BID: 97170 // 
            
            
            
            JVNDB: JVNDB-2017-002723 // 
            
            
            
            CNNVD: CNNVD-201703-1332 // 
            
            
            
            NVD: CVE-2017-2689

REFERENCES
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-327980.pdf
Trust: 2.5
url:https://ics-cert.us-cert.gov/advisories/icsa-17-087-01
Trust: 1.9
url:http://www.securitytracker.com/id/1038160
Trust: 1.6
url:http://www.securityfocus.com/bid/97170
Trust: 1.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2689
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2689
Trust: 0.8
url:http://subscriber.communications.siemens.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-03650 // 
            
            
            
            BID: 97170 // 
            
            
            
            JVNDB: JVNDB-2017-002723 // 
            
            
            
            CNNVD: CNNVD-201703-1332 // 
            
            
            
            NVD: CVE-2017-2689

CREDITS
Maxim Rupp
Trust: 0.3
sources:
            
            
            BID: 97170

SOURCES
db:IVDid:683a6c58-61fd-4fc8-afa8-1ac889ed64f1
db:CNVDid:CNVD-2017-03650
db:BIDid:97170
db:JVNDBid:JVNDB-2017-002723
db:CNNVDid:CNNVD-201703-1332
db:NVDid:CVE-2017-2689

LAST UPDATE DATE
2025-04-20T23:20:05.183000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-03650date:2017-03-29T00:00:00
db:BIDid:97170date:2017-03-28T00:00:00
db:JVNDBid:JVNDB-2017-002723date:2017-04-26T00:00:00
db:CNNVDid:CNNVD-201703-1332date:2019-10-23T00:00:00
db:NVDid:CVE-2017-2689date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:683a6c58-61fd-4fc8-afa8-1ac889ed64f1date:2017-03-29T00:00:00
db:CNVDid:CNVD-2017-03650date:2017-03-29T00:00:00
db:BIDid:97170date:2017-03-28T00:00:00
db:JVNDBid:JVNDB-2017-002723date:2017-04-26T00:00:00
db:CNNVDid:CNNVD-201703-1332date:2017-03-30T00:00:00
db:NVDid:CVE-2017-2689date:2017-03-29T01:59:01.813