Siemens RUGGEDCOM NMS

An attacker could execute arbitrary code or inject malicious content on the RUGGEDCOM NMS management system via a cross-site request forgery or cross-site scripting attack, potentially compromising the ability to manage and monitor critical network infrastructure.

Network management staff and operators at utilities and industrial sites using Siemens RUGGEDCOM NMS to manage ruggedized network equipment (routers, switches, gateways) in substations, water treatment plants, and control centers.

An attacker sends a crafted request (CSRF) or injects malicious scripts (XSS) that exploits insufficient request validation and output encoding in the RUGGEDCOM NMS web interface. When a logged-in user views or interacts with the malicious content, the attacker's code executes with the user's privileges, allowing unauthorized actions on managed devices or the NMS itself.