Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2

Act Now9.8SSA-419740Mar 14, 2023

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

Multiple third-party component vulnerabilities exist in RUGGEDCOM and SCALANCE industrial routers and cellular gateways. Affected components include Busybox, Linux Kernel, OpenSSL, OpenVPN, and others. The vulnerabilities include improper neutralization of special elements, command injection vectors, denial of service conditions, and authentication bypass issues. These vulnerabilities allow code injection and denial of service attacks through various input handling and command processing flaws.

What this means

What could happen

An attacker on the network could exploit these vulnerabilities to run arbitrary commands on the router, disrupt communications between remote facilities and the control center, or access sensitive configuration data. This could cause loss of connectivity to field sites, interruption of SCADA communications, or compromise of credentials used for remote operations.

Who's at risk

Water authorities and utilities using RUGGEDCOM cellular gateways (RM1224) for remote site connectivity or SCALANCE industrial routers (M8xx, MUM8xx, S615 series) for WAN/cellular backhaul to SCADA systems, RTUs, or remote terminal units. These devices are critical for maintaining connectivity between control centers and distributed field equipment.

How it could be exploited

An attacker with network access to the router (which manages ICS connectivity) could send specially crafted network requests or configuration commands that exploit command injection, buffer overflow, or authentication bypass flaws in Busybox, the Linux kernel, or OpenSSL. The attacker could then execute arbitrary commands with router privileges, allowing them to modify routing behavior, intercept traffic, or disconnect remote field equipment from the control network.

Prerequisites

Network access to the affected router (typically on the industrial network or DMZ)
No authentication required for some exploitation vectors based on CVSS vector AV:N/PR:N
The router must be running firmware version prior to V7.2

Remotely exploitableNo authentication requiredLow complexityActively exploited (KEV)EPSS score 88.3% (very high exploit probability)Affects critical network infrastructureMultiple vulnerability classes including code injection and denial of service

Exploitability

Actively exploited — confirmed by CISA KEV

Affected products (20)

20 with fix

ProductAffected VersionsFix Status

RUGGEDCOM RM1224 LTE(4G) EU< V7.27.2

RUGGEDCOM RM1224 LTE(4G) NAM< V7.27.2

SCALANCE M804PB< V7.27.2

SCALANCE M812-1 ADSL-Router (Annex A)< V7.27.2

SCALANCE M812-1 ADSL-Router (Annex B)< V7.27.2

Remediation & Mitigation

0/2

Do now

0/2

RUGGEDCOM RM1224 LTE(4G) EU

HOTFIXUpdate RUGGEDCOM RM1224 LTE(4G) EU and NAM, and all SCALANCE products to firmware version 7.2 or later

All products

HARDENINGDuring patching, segregate affected routers from operational networks if possible, or schedule updates during low-traffic windows to avoid communication loss to remote sites

CVEs (65)

CVE-2018-25032 CVE-2019-1125 CVE-2021-4034 CVE-2021-4149 CVE-2021-26401 CVE-2021-42373 CVE-2021-42374 CVE-2021-42375 CVE-2021-42376 CVE-2021-42377 CVE-2021-42378 CVE-2021-42379 CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42383 CVE-2021-42384 CVE-2021-42385 CVE-2021-42386 CVE-2022-0001 CVE-2022-0002 CVE-2022-0494 CVE-2022-0547 CVE-2022-1011 CVE-2022-1016 CVE-2022-1198 CVE-2022-1199 CVE-2022-1292 CVE-2022-1304 CVE-2022-1343 CVE-2022-1353 CVE-2022-1473 CVE-2022-1516 CVE-2022-1652 CVE-2022-1729 CVE-2022-1734 CVE-2022-1974 CVE-2022-1975 CVE-2022-2380 CVE-2022-2588 CVE-2022-2639 CVE-2022-20158 CVE-2022-23036 CVE-2022-23037 CVE-2022-23038 CVE-2022-23039 CVE-2022-23040 CVE-2022-23041 CVE-2022-23042 CVE-2022-23308 CVE-2022-26490 CVE-2022-28356 CVE-2022-28390 CVE-2022-30065 CVE-2022-30594 CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208 CVE-2022-32296 CVE-2022-32981 CVE-2022-33981 CVE-2022-35252 CVE-2022-36879 CVE-2022-36946

View full Siemens ProductCERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/e8ffd710-d3ba-4581-bf8d-e8dfb11e2be0