CVSS: 7.2EPSS: 0%CPEs: 40EXPL: 0CVE-2023-49692
https://notcve.org/view.php?id=CVE-2023-49692
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) (All versions < V7.2.2), SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) (All versions < V7.2.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.2.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.2.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.2.2), SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) (All versions < V7.2.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.2.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.2.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.2.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.2.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.2.2), SCALANCE S615 (6GK5615-0AA00-2AA2) (All versions < V7.2.2), SCALANCE S615 EEC (6GK5615-0AA01-2AA2) (All versions < V7.2.2), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.0.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the parsing of the IPSEC configuration. This could allow malicious local administrators to issue commands on system level after a new connection is established. Se ha identificado una vulnerabilidad en: RUGGEDCOM RM1224 LTE(4G) EU (Todas las versiones < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (Todas las versiones < V7.2.2), SCALANCE M804PB (Todas las versiones < V7.2.2), SCALANCE M812-1 ADSL-Router (Anexo A) (Todas las versiones < V7.2.2), SCALANCE M812-1 ADSL-Router (Anexo B) (Todas las versiones < V7.2.2), SCALANCE M816-1 ADSL-Router (Anexo A) (Todas las versiones < V7.2.2), SCALANCE M816-1 ADSL-Router (Anexo B) (Todas las versiones < V7.2.2), SCALANCE M826-2 SHDSL-Router (Todas las versiones < V7.2.2), SCALANCE M874-2 ( Todas las versiones < V7.2.2), SCALANCE M874-3 (Todas las versiones < V7.2.2), SCALANCE M876-3 (EVDO) (Todas las versiones < V7.2.2), SCALANCE M876-3 (ROK) (Todas las versiones < V7. 2.2), SCALANCE M876-4 (Todas las versiones < V7.2.2), SCALANCE M876-4 (EU) (Todas las versiones < V7.2.2), SCALANCE M876-4 (NAM) (Todas las versiones < V7.2.2), SCALANCE MUM853 -1 (UE) (Todas las versiones < V7.2.2), SCALANCE MUM856-1 (UE) (Todas las versiones < V7.2.2), SCALANCE MUM856-1 (RoW) (Todas las versiones < V7.2.2), SCALANCE S615 (Todas versiones < V7.2.2), SCALANCE S615 EEC (Todas las versiones < V7.2.2). Existe una vulnerabilidad de neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo con privilegios de root en el análisis de la configuración IPSEC. Esto podría permitir que administradores locales malintencionados emitan comandos a nivel del sistema después de que se establezca una nueva conexión. • https://cert-portal.siemens.com/productcert/html/ssa-068047.html https://cert-portal.siemens.com/productcert/html/ssa-602936.html https://cert-portal.siemens.com/productcert/pdf/ssa-068047.pdf • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 40EXPL: 0CVE-2023-49691
https://notcve.org/view.php?id=CVE-2023-49691
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 (6GK5615-0AA00-2AA2) (All versions < V8.0), SCALANCE S615 EEC (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.0.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the handling of the DDNS configuration. This could allow malicious local administrators to issue commands on system level after a successful IP address update. Se ha identificado una vulnerabilidad en: RUGGEDCOM RM1224 LTE(4G) EU (Todas las versiones < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (Todas las versiones < V8.0), SCALANCE M804PB (Todas las versiones < V8.0), SCALANCE M812-1 ADSL-Router (Anexo A) (Todas las versiones < V8.0), SCALANCE M812-1 ADSL-Router (Anexo B) (Todas las versiones < V8.0), SCALANCE M816-1 ADSL-Router (Anexo A) (Todas las versiones < V8.0), SCALANCE M816-1 ADSL-Router (Anexo B) (Todas las versiones < V8.0), SCALANCE M826-2 SHDSL-Router (Todas las versiones < V8.0), SCALANCE M874-2 ( Todas las versiones < V8.0), SCALANCE M874-3 (Todas las versiones < V8.0), SCALANCE M876-3 (EVDO) (Todas las versiones < V8.0), SCALANCE M876-3 (ROK) (Todas las versiones < V8. 0), SCALANCE M876-4 (Todas las versiones < V8.0), SCALANCE M876-4 (EU) (Todas las versiones < V8.0), SCALANCE M876-4 (NAM) (Todas las versiones < V8.0), SCALANCE MUM853 -1 (UE) (Todas las versiones < V8.0), SCALANCE MUM856-1 (UE) (Todas las versiones < V8.0), SCALANCE MUM856-1 (RoW) (Todas las versiones < V8.0), SCALANCE S615 (Todas versiones < V8.0), SCALANCE S615 EEC (Todas las versiones < V8.0). Existe una vulnerabilidad de neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo con privilegios de root en el manejo de la configuración DDNS. Esto podría permitir a administradores locales maliciosos emitir comandos a nivel del sistema después de una actualización exitosa de la dirección IP. • https://cert-portal.siemens.com/productcert/html/ssa-180704.html https://cert-portal.siemens.com/productcert/html/ssa-602936.html https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf https://cert-portal.siemens.com/productcert/html/ssa-690517.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 372EXPL: 0CVE-2022-31765
https://notcve.org/view.php?id=CVE-2022-31765
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Los dispositivos afectados no autorizan apropiadamente la función change password de la interfaz web. Esto podría permitir a usuarios poco privilegiado escalar sus privilegios • https://cert-portal.siemens.com/productcert/pdf/ssa-552702.pdf • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 4%CPEs: 40EXPL: 0CVE-2021-41990
https://notcve.org/view.php?id=CVE-2021-41990
The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur. El plugin gmp en strongSwan versiones anteriores a 5.9.4, presenta un desbordamiento de enteros remoto por medio de un certificado diseñado con una firma RSASSA-PSS. Por ejemplo, esto puede ser desencadenado por un certificado de CA autofirmado no relacionado enviado por un iniciador. • https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf https://github.com/strongswan/strongswan/releases/tag/5.9.4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FJSATD2R2XHTG4P63GCMQ2N7EWKMME5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQSQ3BEC22NF4NCDZVCT4P3Q2ZIAJXGJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3TQ32JLJOBJDB2EJKSX2PBPB5NFG2D4 https://www.debian.org/security/2021/dsa& • CWE-190: Integer Overflow or Wraparound •