Siemens RUGGEDCOM Devices

An attacker positioned between a network administrator and a RUGGEDCOM device could intercept SSH sessions and read or modify configuration commands being sent to the device, potentially altering process setpoints, routing rules, or safety parameters on critical infrastructure networks.

Water utilities, electrical utilities, and other critical infrastructure operators managing RUGGEDCOM industrial network devices—specifically any organization using RUGGEDCOM switches and routers (RMC, RS, RSG, RSL, RST series) for network connectivity and management in OT environments. These devices are commonly used to provide managed network access and monitoring for SCADA systems and remote substations.

An attacker must be on the same network segment or in a position to intercept traffic (man-in-the-middle). They can leverage the weak SSH ciphers offered by default to decrypt or intercept SSH sessions to the device. No user authentication is required if the attacker can forge SSH packets using the weak cipher algorithms.