CVE-2021-37173
published 2021-09-14CVE-2021-37173: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All…
PriorityP258high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.61%
73.4th percentile
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The command line interface of affected devices insufficiently restrict file read and write operations for low privileged users. This could allow an authenticated remote attacker to escalate privileges and gain root access to the device.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | ruggedcom_rox_mx5000 | — | — |
| siemens | ruggedcom_rox_mx5000_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1400 | — | — |
| siemens | ruggedcom_rox_rx1400_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1500 | — | — |
| siemens | ruggedcom_rox_rx1500_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1501 | — | — |
| siemens | ruggedcom_rox_rx1501_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1510 | — | — |
| siemens | ruggedcom_rox_rx1510_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1511 | — | — |
| siemens | ruggedcom_rox_rx1511_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1512 | — | — |
| siemens | ruggedcom_rox_rx1512_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1524 | — | — |
| siemens | ruggedcom_rox_rx1524_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx1536 | — | — |
| siemens | ruggedcom_rox_rx1536_firmware | < 2.14.1 | 2.14.1 |
| siemens | ruggedcom_rox_rx5000 | — | — |
| siemens | ruggedcom_rox_rx5000_firmware | < 2.14.1 | 2.14.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Target vulnerability is in the CLI of RUGGEDCOM ROX devices — monitor for authenticated low-privileged users performing unexpected file read/write operations via the command line interface that could indicate privilege escalation attempts toward root access. ↗
- →No known public exploits exist for this vulnerability as of advisory publication; prioritize detection of anomalous authenticated CLI sessions on affected RUGGEDCOM ROX devices rather than signature-based exploit detection. ↗
- ·All RUGGEDCOM ROX MX5000, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 devices running firmware versions prior to V2.14.1 are affected; patched version is V2.14.1 or later. ↗
- ·The vulnerability requires only low privileges (authenticated user) and is remotely exploitable with low attack complexity (CVSS v3 8.8, AV:N/AC:L/PR:L/UI:N), meaning any authenticated CLI user on a network-accessible device is a potential attacker. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-59r2-367p-xv4j: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
ghsa_unreviewed·2022-05-24
CVE-2021-37173 [MEDIUM] CWE-200 GHSA-59r2-367p-xv4j: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices have an exposure of sensitive information vulnerability, if exploited, it could allow an authenticated attacker to extract data via Secure Shell (SSH).
CISA ICS
Siemens RUGGEDCOM ROX (Update A)
cisa_ics·2021-09-16
Siemens RUGGEDCOM ROX (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens RUGGEDCOM ROX (Update A)
Last RevisedOctober 14, 2021
Alert CodeICSA-21-259-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM ROX
--------- Begin Update A Part 1 of 2 ---------
- Vulnerabilities: Improper Privilege Management, Execution with Unnecessary Privileges, Improper Handling of Insufficient Permissions or Privileges
--------- End Update A Part 1 of 2 ---------
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-21-259-01 S
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-14
Published