A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All v
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in V3.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). The "Load Configuration from Local PC" functionality in the web interface of affected products contains a race condition vulnerability. This could allow an authenticated remote attacker to make the affected product load an attacker controlled configuration instead of the legitimate one. Successful exploitation requires that a legitimate administrator invokes the functionality and the attacker wins the race condition.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Siemens RUGGEDCOM RST2428P
fixed in V3.2
- Siemens SCALANCE XCH328
fixed in V3.2
- Siemens SCALANCE XCM324
fixed in V3.2
- Siemens SCALANCE XCM328
fixed in V3.2
- Siemens SCALANCE XCM332
fixed in V3.2
- Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC)
fixed in V3.2
- Siemens SCALANCE XRM334 (230 V AC, 12xFO)
fixed in V3.2
- Siemens SCALANCE XRM334 (230 V AC, 8xFO)
fixed in V3.2
- Siemens SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)
fixed in V3.2
- Siemens SCALANCE XRM334 (24 V DC, 12xFO)
fixed in V3.2
- Siemens SCALANCE XRM334 (24 V DC, 8xFO)
fixed in V3.2
- Siemens SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)
fixed in V3.2
- Siemens SCALANCE XRM334 (2x230 V AC, 12xFO)
fixed in V3.2
- Siemens SCALANCE XRM334 (2x230 V AC, 8xFO)
fixed in V3.2
- Siemens SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)
fixed in V3.2