CyberSecBulletin
CVE-2024-39675NVD status: Deferred

RUGGEDCOM RMC30: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Published Updated By the CyberSecBulletin desk

CVE-2024-39675 is a high-severity exposure of sensitive system information to an unauthorized control sphere vulnerability in RUGGEDCOM RMC30 from Siemens, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists version V4.3.10 as the first without the flaw, so updating RUGGEDCOM RMC30 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update RUGGEDCOM RMC30 to V4.3.10 or a later version.
  2. Update RUGGEDCOM RMC30NC to V4.3.10 or a later version.
  3. Update RUGGEDCOM RP110 to V4.3.10 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensRUGGEDCOM RMC30before V4.3.10V4.3.10
SiemensRUGGEDCOM RMC30NCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RP110before V4.3.10V4.3.10
SiemensRUGGEDCOM RP110NCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS400before V4.3.10V4.3.10
SiemensRUGGEDCOM RS400NCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS401before V4.3.10V4.3.10
SiemensRUGGEDCOM RS401NCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416before V4.3.10V4.3.10
SiemensRUGGEDCOM RS416NCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416NCv2 V4.Xbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416NCv2 V5.Xbefore V5.9.0V5.9.0
SiemensRUGGEDCOM RS416Pbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416PNCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416PNCv2 V4.Xbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416PNCv2 V5.Xbefore V5.9.0V5.9.0
SiemensRUGGEDCOM RS416Pv2 V4.Xbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416Pv2 V5.Xbefore V5.9.0V5.9.0
SiemensRUGGEDCOM RS416v2 V4.Xbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS416v2 V5.Xbefore V5.9.0V5.9.0
SiemensRUGGEDCOM RS910before V4.3.10V4.3.10
SiemensRUGGEDCOM RS910Lall versionsNot stated
SiemensRUGGEDCOM RS910LNCall versionsNot stated
SiemensRUGGEDCOM RS910NCbefore V4.3.10V4.3.10
SiemensRUGGEDCOM RS910Wbefore V4.3.10V4.3.10

Version data comes from the organisation that assigned the CVE; 27 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (siemens.com).

Scoring systemScoreSeverityScored by
CVSS 4.08.7HighCNA (siemens.com)
CVSS 3.18.8HighCNA (siemens.com)

Official description

A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4.3.10), RUGGEDCOM RP110NC (All versions < V4.3.10), RUGGEDCOM RS400 (All versions < V4.3.10), RUGGEDCOM RS400NC (All versions < V4.3.10), RUGGEDCOM RS401 (All versions < V4.3.10), RUGGEDCOM RS401NC (All versions < V4.3.10), RUGGEDCOM RS416 (All versions < V4.3.10), RUGGEDCOM RS416NC (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416P (All versions < V4.3.10), RUGGEDCOM RS416PNC (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS910 (All versions < V4.3.10), RUGGEDCOM RS910L (All versions), RUGGEDCOM RS910LNC (All versions), RUGGEDCOM RS910NC (All versions < V4.3.10), RUGGEDCOM RS910W (All versions < V4.3.10), RUGGEDCOM RS920L (All versions), RUGGEDCOM RS920LNC (All versions), RUGGEDCOM RS920W (All versions). In some configurations the affected products wrongly enable the Modbus service in non-managed VLANS. Only serial devices are affected by this vulnerability.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

How developers prevent this class of flaw

  • Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs

More Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerabilities (CWE-497)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in RUGGEDCOM RMC30

All RUGGEDCOM RMC30 vulnerabilities

Recent Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerabilities

Spotted an error? Tell us.