CVE-2024-39675
published 2024-07-09CVE-2024-39675: A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions <…
PriorityP347high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.28%
20.1th percentile
A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4.3.10), RUGGEDCOM RP110NC (All versions < V4.3.10), RUGGEDCOM RS400 (All versions < V4.3.10), RUGGEDCOM RS400NC (All versions < V4.3.10), RUGGEDCOM RS401 (All versions < V4.3.10), RUGGEDCOM RS401NC (All versions < V4.3.10), RUGGEDCOM RS416 (All versions < V4.3.10), RUGGEDCOM RS416NC (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416P (All versions < V4.3.10), RUGGEDCOM RS416PNC (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS910 (All versions < V4.3.10), RUGGEDCOM RS910L (All versions), RUGGEDCOM RS910LNC (All versions), RUGGEDCOM RS910NC (All versions < V4.3.10), RUGGEDCOM RS910W (All versions < V4.3.10), RUGGEDCOM RS920L (All versions), RUGGEDCOM RS920LNC (All versions), RUGGEDCOM RS920W (All versions). In some configurations the affected products wrongly enable the Modbus service in non-managed VLANS. Only serial devices are affected by this vulnerability.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | ruggedcom_rmc30 | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rmc30nc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rp110 | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rp110nc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs400 | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs400nc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs401 | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs401nc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416 | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416nc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416ncv2_v4.x | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416ncv2_v5.x | < V5.9.0 | V5.9.0 |
| siemens | ruggedcom_rs416p | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416pnc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416pncv2_v4.x | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416pncv2_v5.x | < V5.9.0 | V5.9.0 |
| siemens | ruggedcom_rs416pv2_v4.x | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416pv2_v5.x | < V5.9.0 | V5.9.0 |
| siemens | ruggedcom_rs416v2_v4.x | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs416v2_v5.x | < V5.9.0 | V5.9.0 |
| siemens | ruggedcom_rs910 | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs910l | < * | * |
| siemens | ruggedcom_rs910lnc | < * | * |
| siemens | ruggedcom_rs910nc | < V4.3.10 | V4.3.10 |
| siemens | ruggedcom_rs910w | < V4.3.10 | V4.3.10 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2fxj-84g8-m9vw: A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4
ghsa_unreviewed·2024-07-09
CVE-2024-39675 [HIGH] CWE-497 GHSA-2fxj-84g8-m9vw: A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4
A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4.3.10), RUGGEDCOM RP110NC (All versions < V4.3.10), RUGGEDCOM RS400 (All versions < V4.3.10), RUGGEDCOM RS400NC (All versions < V4.3.10), RUGGEDCOM RS401 (All versions < V4.3.10), RUGGEDCOM RS401NC (All versions < V4.3.10), RUGGEDCOM RS416 (All versions < V4.3.10), RUGGEDCOM RS416NC (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416P (All versions < V4.3.10), RUGGEDCOM RS416PNC (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V4.X (All versions <
CISA ICS
Siemens RUGGEDCOM
cisa_ics·2024-07-11·CVSS 7.7
[HIGH] Siemens RUGGEDCOM
ICS Advisory
##
Siemens RUGGEDCOM
Release DateJuly 11, 2024
Alert CodeICSA-24-193-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM
- Vulnerabilities: Exposure of Sensitive Information to an Unauthorized Actor, Incorrect Privilege Assignment, Exposure of Sensitive
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-09
Published