Siemens AG ROX II
At a glance
- Source
- NVD
- EPSS
- EPSS 3.57 % · percentile 89 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Modified
Description
A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the SSH interface in on port 22/tcp. The attacker must be authenticated to exploit the vulnerability. The vulnerability could allow an attacker to execute arbitrary code on the device.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-5738
- GCVE · GCVE-0-2018-13802
Affected configurations (NVD CPE)
cpe:2.3:o:siemens:rox_ii_firmware:*:*:*:*:*:*:*:*< 2.12.1
Affected products
| Product | Versions |
|---|---|
| Siemens AG · ROX II | affected All versions < V2.12.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |