CVE-2023-49691

Severity Score

6.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (EVDO) (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 (6GK5615-0AA00-2AA2) (All versions < V8.0), SCALANCE S615 EEC (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.0.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.0.2). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the handling of the DDNS configuration. This could allow malicious local administrators to issue commands on system level after a successful IP address update.

Se ha identificado una vulnerabilidad en:
RUGGEDCOM RM1224 LTE(4G) EU (Todas las versiones < V8.0),
RUGGEDCOM RM1224 LTE(4G) NAM (Todas las versiones < V8.0),
SCALANCE M804PB (Todas las versiones < V8.0),
SCALANCE M812-1 ADSL-Router (Anexo A) (Todas las versiones < V8.0),
SCALANCE M812-1 ADSL-Router (Anexo B) (Todas las versiones < V8.0),
SCALANCE M816-1 ADSL-Router (Anexo A) (Todas las versiones < V8.0),
SCALANCE M816-1 ADSL-Router (Anexo B) (Todas las versiones < V8.0),
SCALANCE M826-2 SHDSL-Router (Todas las versiones < V8.0),
SCALANCE M874-2 ( Todas las versiones < V8.0),
SCALANCE M874-3 (Todas las versiones < V8.0),
SCALANCE M876-3 (EVDO) (Todas las versiones < V8.0),
SCALANCE M876-3 (ROK) (Todas las versiones < V8. 0),
SCALANCE M876-4 (Todas las versiones < V8.0),
SCALANCE M876-4 (EU) (Todas las versiones < V8.0),
SCALANCE M876-4 (NAM) (Todas las versiones < V8.0),
SCALANCE MUM853 -1 (UE) (Todas las versiones < V8.0),
SCALANCE MUM856-1 (UE) (Todas las versiones < V8.0),
SCALANCE MUM856-1 (RoW) (Todas las versiones < V8.0),
SCALANCE S615 (Todas versiones < V8.0),
SCALANCE S615 EEC (Todas las versiones < V8.0).
Existe una vulnerabilidad de neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo con privilegios de root en el manejo de la configuración DDNS. Esto podría permitir a administradores locales maliciosos emitir comandos a nivel del sistema después de una actualización exitosa de la dirección IP.

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.0). An Improper Neutralization of Special Elements used in an OS Command with root privileges vulnerability exists in the handling of the DDNS configuration. This could allow malicious local administrators to issue commands on system level after a successful IP address update.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-11-29 CVE Reserved
2023-12-12 CVE Published
2023-12-19 EPSS Updated
2024-08-13 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CAPEC

References (4)

URL	Tag	Source
https://cert-portal.siemens.com/productcert/html/ssa-180704.html
https://cert-portal.siemens.com/productcert/html/ssa-602936.html
https://cert-portal.siemens.com/productcert/html/ssa-690517.html

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf	2024-02-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"	6gk6108-4am00-2ba2 Firmware Search vendor "Siemens" for product "6gk6108-4am00-2ba2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk6108-4am00-2ba2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk6108-4am00-2ba2 Search vendor "Siemens" for product "6gk6108-4am00-2ba2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk6108-4am00-2da2 Firmware Search vendor "Siemens" for product "6gk6108-4am00-2da2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk6108-4am00-2da2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk6108-4am00-2da2 Search vendor "Siemens" for product "6gk6108-4am00-2da2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5804-0ap00-2aa2 Firmware Search vendor "Siemens" for product "6gk5804-0ap00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5804-0ap00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5804-0ap00-2aa2 Search vendor "Siemens" for product "6gk5804-0ap00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5812-1aa00-2aa2 Firmware Search vendor "Siemens" for product "6gk5812-1aa00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5812-1aa00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5812-1aa00-2aa2 Search vendor "Siemens" for product "6gk5812-1aa00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5812-1ba00-2aa2 Firmware Search vendor "Siemens" for product "6gk5812-1ba00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5812-1ba00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5812-1ba00-2aa2 Search vendor "Siemens" for product "6gk5812-1ba00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5816-1aa00-2aa2 Firmware Search vendor "Siemens" for product "6gk5816-1aa00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5816-1aa00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5816-1aa00-2aa2 Search vendor "Siemens" for product "6gk5816-1aa00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5816-1ba00-2aa2 Firmware Search vendor "Siemens" for product "6gk5816-1ba00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5816-1ba00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5816-1ba00-2aa2 Search vendor "Siemens" for product "6gk5816-1ba00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5826-2ab00-2ab2 Firmware Search vendor "Siemens" for product "6gk5826-2ab00-2ab2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5826-2ab00-2ab2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5826-2ab00-2ab2 Search vendor "Siemens" for product "6gk5826-2ab00-2ab2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5874-2aa00-2aa2 Firmware Search vendor "Siemens" for product "6gk5874-2aa00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5874-2aa00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5874-2aa00-2aa2 Search vendor "Siemens" for product "6gk5874-2aa00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5874-3aa00-2aa2 Firmware Search vendor "Siemens" for product "6gk5874-3aa00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5874-3aa00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5874-3aa00-2aa2 Search vendor "Siemens" for product "6gk5874-3aa00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5876-3aa02-2ba2 Firmware Search vendor "Siemens" for product "6gk5876-3aa02-2ba2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5876-3aa02-2ba2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5876-3aa02-2ba2 Search vendor "Siemens" for product "6gk5876-3aa02-2ba2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5876-3aa02-2ea2 Firmware Search vendor "Siemens" for product "6gk5876-3aa02-2ea2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5876-3aa02-2ea2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5876-3aa02-2ea2 Search vendor "Siemens" for product "6gk5876-3aa02-2ea2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5876-4aa10-2ba2 Firmware Search vendor "Siemens" for product "6gk5876-4aa10-2ba2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5876-4aa10-2ba2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5876-4aa10-2ba2 Search vendor "Siemens" for product "6gk5876-4aa10-2ba2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5876-4aa00-2ba2 Firmware Search vendor "Siemens" for product "6gk5876-4aa00-2ba2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5876-4aa00-2ba2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5876-4aa00-2ba2 Search vendor "Siemens" for product "6gk5876-4aa00-2ba2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5876-4aa00-2da2 Firmware Search vendor "Siemens" for product "6gk5876-4aa00-2da2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5876-4aa00-2da2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5876-4aa00-2da2 Search vendor "Siemens" for product "6gk5876-4aa00-2da2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5853-2ea00-2da1 Firmware Search vendor "Siemens" for product "6gk5853-2ea00-2da1 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5853-2ea00-2da1 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5853-2ea00-2da1 Search vendor "Siemens" for product "6gk5853-2ea00-2da1"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5856-2ea00-3da1 Firmware Search vendor "Siemens" for product "6gk5856-2ea00-3da1 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5856-2ea00-3da1 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5856-2ea00-3da1 Search vendor "Siemens" for product "6gk5856-2ea00-3da1"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5856-2ea00-3aa1 Firmware Search vendor "Siemens" for product "6gk5856-2ea00-3aa1 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5856-2ea00-3aa1 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5856-2ea00-3aa1 Search vendor "Siemens" for product "6gk5856-2ea00-3aa1"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5615-0aa00-2aa2 Firmware Search vendor "Siemens" for product "6gk5615-0aa00-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5615-0aa00-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5615-0aa00-2aa2 Search vendor "Siemens" for product "6gk5615-0aa00-2aa2"	-	-	Safe
Siemens Search vendor "Siemens"	6gk5615-0aa01-2aa2 Firmware Search vendor "Siemens" for product "6gk5615-0aa01-2aa2 Firmware"	< 8.0 Search vendor "Siemens" for product "6gk5615-0aa01-2aa2 Firmware" and version " < 8.0"	-	Affected	in	Siemens Search vendor "Siemens"	6gk5615-0aa01-2aa2 Search vendor "Siemens" for product "6gk5615-0aa01-2aa2"	-	-	Safe