Siemens RUGGEDCOM i800

CVE-2017-12736

HIGH 8.8

En bref

Source: NVD
EPSS: EPSS 1.07 % · centile 65 (2026-10-31)
État: PUBLISHED
Publiée: 2017-12-26 04:00 UTC
Mise à jour: 2025-08-12 11:10 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions.

Faiblesses (CWE)

CWE-1188 — Initialisation par défaut non sécurisée d'une ressource
CWE-665 — Initialisation incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	siemens
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.0	HIGH 8.8	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Secondary)
CVSS 2.0	MEDIUM 5.8	AV:A/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2017-4275
GCVE · GCVE-0-2017-12736

Avis du CERT-FR

CERTFR-2017-AVI-326 — Vulnérabilité dans SCADA Siemens Ruggedcom Discovery Protocol · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:scalance_xb-200_firmware:*:*:*:*:*:*:*:* ≥ 3.0
cpe:2.3:o:siemens:scalance_xc-200_firmware:*:*:*:*:*:*:*:* ≥ 3.0
cpe:2.3:o:siemens:scalance_xp-200_firmware:*:*:*:*:*:*:*:* ≥ 3.0
cpe:2.3:o:siemens:scalance_xr300-wg_firmware:*:*:*:*:*:*:*:* ≥ 3.0
cpe:2.3:o:siemens:scalance_xr-500_firmware:*:*:*:*:*:*:*:* ≥ 6.1
cpe:2.3:o:siemens:scalance_xm-400_firmware:*:*:*:*:*:*:*:* ≥ 6.1
cpe:2.3:o:siemens:ruggedcom_ros:*:*:*:*:*:*:*:* < 5.0.1
cpe:2.3:o:siemens:ruggedcom_ros:*:*:*:*:*:*:*:* < 4.3.4

Produits affectés

Produit	Versions
Siemens · RUGGEDCOM i800	affected 0 < V4.3.4
Siemens · RUGGEDCOM i800NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM i801	affected 0 < V4.3.4
Siemens · RUGGEDCOM i801NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM i802	affected 0 < V4.3.4
Siemens · RUGGEDCOM i802NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM i803	affected 0 < V4.3.4
Siemens · RUGGEDCOM i803NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM M2100	affected 0 < V4.3.4
Siemens · RUGGEDCOM M2100NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM M2200	affected 0 < V4.3.4
Siemens · RUGGEDCOM M2200NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM M969	affected 0 < V4.3.4
Siemens · RUGGEDCOM M969NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM RMC30	affected 0 < V4.3.4
Siemens · RUGGEDCOM RMC30NC	affected 0 < V4.3.4
Siemens · RUGGEDCOM RMC8388 V4.X	affected 0 < V4.3.4
Siemens · RUGGEDCOM RMC8388 V5.X	affected 0 < V5.0.1
Siemens · RUGGEDCOM RMC8388NC V4.X	affected 0 < V4.3.4
Siemens · RUGGEDCOM RMC8388NC V5.X	affected 0 < V5.0.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens RUGGEDCOM i800