CVSS: 7.2EPSS: 0%CPEs: 40EXPL: 0CVE-2023-49692
https://notcve.org/view.php?id=CVE-2023-49692
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 (6GK5615-0AA00-2AA2) (All versions < V7.2.2), SCALANCE S615 EEC (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.0.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the parsing of the IPSEC configuration. This could allow malicious local administrators to issue commands on system level after a new connection is established. Se ha identificado una vulnerabilidad en: RUGGEDCOM RM1224 LTE(4G) EU (Todas las versiones < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (Todas las versiones < V7.2.2), SCALANCE M804PB (Todas las versiones < V7.2.2), SCALANCE M812-1 ADSL-Router (Anexo A) (Todas las versiones < V7.2.2), SCALANCE M812-1 ADSL-Router (Anexo B) (Todas las versiones < V7.2.2), SCALANCE M816-1 ADSL-Router (Anexo A) (Todas las versiones < V7.2.2), SCALANCE M816-1 ADSL-Router (Anexo B) (Todas las versiones < V7.2.2), SCALANCE M826-2 SHDSL-Router (Todas las versiones < V7.2.2), SCALANCE M874-2 ( Todas las versiones < V7.2.2), SCALANCE M874-3 (Todas las versiones < V7.2.2), SCALANCE M876-3 (EVDO) (Todas las versiones < V7.2.2), SCALANCE M876-3 (ROK) (Todas las versiones < V7. 2.2), SCALANCE M876-4 (Todas las versiones < V7.2.2), SCALANCE M876-4 (EU) (Todas las versiones < V7.2.2), SCALANCE M876-4 (NAM) (Todas las versiones < V7.2.2), SCALANCE MUM853 -1 (UE) (Todas las versiones < V7.2.2), SCALANCE MUM856-1 (UE) (Todas las versiones < V7.2.2), SCALANCE MUM856-1 (RoW) (Todas las versiones < V7.2.2), SCALANCE S615 (Todas versiones < V7.2.2), SCALANCE S615 EEC (Todas las versiones < V7.2.2). Existe una vulnerabilidad de neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo con privilegios de root en el análisis de la configuración IPSEC. Esto podría permitir que administradores locales malintencionados emitan comandos a nivel del sistema después de que se establezca una nueva conexión. • https://cert-portal.siemens.com/productcert/html/ssa-068047.html https://cert-portal.siemens.com/productcert/html/ssa-602936.html https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 40EXPL: 0CVE-2023-49691
https://notcve.org/view.php?id=CVE-2023-49691
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 (6GK5615-0AA00-2AA2) (All versions < V8.0), SCALANCE S615 EEC (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.0.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the handling of the DDNS configuration. This could allow malicious local administrators to issue commands on system level after a successful IP address update. Se ha identificado una vulnerabilidad en: RUGGEDCOM RM1224 LTE(4G) EU (Todas las versiones < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (Todas las versiones < V8.0), SCALANCE M804PB (Todas las versiones < V8.0), SCALANCE M812-1 ADSL-Router (Anexo A) (Todas las versiones < V8.0), SCALANCE M812-1 ADSL-Router (Anexo B) (Todas las versiones < V8.0), SCALANCE M816-1 ADSL-Router (Anexo A) (Todas las versiones < V8.0), SCALANCE M816-1 ADSL-Router (Anexo B) (Todas las versiones < V8.0), SCALANCE M826-2 SHDSL-Router (Todas las versiones < V8.0), SCALANCE M874-2 ( Todas las versiones < V8.0), SCALANCE M874-3 (Todas las versiones < V8.0), SCALANCE M876-3 (EVDO) (Todas las versiones < V8.0), SCALANCE M876-3 (ROK) (Todas las versiones < V8. 0), SCALANCE M876-4 (Todas las versiones < V8.0), SCALANCE M876-4 (EU) (Todas las versiones < V8.0), SCALANCE M876-4 (NAM) (Todas las versiones < V8.0), SCALANCE MUM853 -1 (UE) (Todas las versiones < V8.0), SCALANCE MUM856-1 (UE) (Todas las versiones < V8.0), SCALANCE MUM856-1 (RoW) (Todas las versiones < V8.0), SCALANCE S615 (Todas versiones < V8.0), SCALANCE S615 EEC (Todas las versiones < V8.0). Existe una vulnerabilidad de neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo con privilegios de root en el manejo de la configuración DDNS. Esto podría permitir a administradores locales maliciosos emitir comandos a nivel del sistema después de una actualización exitosa de la dirección IP. • https://cert-portal.siemens.com/productcert/html/ssa-180704.html https://cert-portal.siemens.com/productcert/html/ssa-602936.html https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf https://cert-portal.siemens.com/productcert/html/ssa-690517.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 372EXPL: 0CVE-2022-31765
https://notcve.org/view.php?id=CVE-2022-31765
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Los dispositivos afectados no autorizan apropiadamente la función change password de la interfaz web. Esto podría permitir a usuarios poco privilegiado escalar sus privilegios • https://cert-portal.siemens.com/productcert/pdf/ssa-552702.pdf • CWE-862: Missing Authorization •