CVE-2017-12736 Information

Description

A vulnerability has been identified in RUGGEDCOM ROS for RSL910 devices (All versions ROS V5.0.1) RUGGEDCOM ROS for all other devices (All versions ROS V4.3.4) SCALANCE XB-200/XC-200/XP-200/XR300-WG (All versions between V3.0 (including) and V3.0.2 (excluding)) SCALANCE XR-500/XM-400 (All versions between V6.1 (including) and V6.1.1 (excluding)). After initial configuration the Ruggedcom Discovery Protocol (RCDP) is still able to writeto the device under certain conditions potentially allowing users located in the adjacentnetwork of the targeted device to perform unauthorized administrative actions.

CVSS Vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

http://www.securityfocus.com/bid/101041 http://www.securitytracker.com/id/1039463 http://www.securitytracker.com/id/1039464 https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856721.pdf

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8