SCALANCE MUM856-1 (RoW) vulnerabilities

13 known vulnerabilities in SCALANCE MUM856-1 (RoW) from Siemens. 13 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements used in a Command

  CVE-2024-50572Nov 12, 2024Siemens

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2), SCALANCE M812-1

• 9.8 Critical severity

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All…

  CVE-2024-50557Nov 12, 2024Siemens

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2), SCALANCE M812-1

• 8.0 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Exposure of Data Element to Wrong Session

  CVE-2024-41977Aug 13, 2024Siemens

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1

• 8.8 High severity

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All…

  CVE-2024-41976Aug 13, 2024Siemens

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1

• 8.8 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Unsynchronized Access to Shared Data in a Multithreaded Context

  CVE-2023-44374Nov 14, 2023Siemens

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1

• 9.1 Critical severity

  RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2023-44373Nov 14, 2023SiemensEPSS 1.34%

  Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323.

• 7.2 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Acceptance of Extraneous Untrusted Data With Trusted Data

  CVE-2023-44317Nov 14, 2023Siemens

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.2.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.2.2), SCALANCE M

• 8.6 High severity

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All…

  CVE-2022-31766Oct 11, 2022SiemensEPSS 1.24%

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.1.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.1.2), SCALANCE M

• 8.8 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Missing Authorization

  CVE-2022-31765Oct 11, 2022SiemensEPSS 1.1%

  Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.

• 7.5 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Allocation of Resources Without Limits or Throttling

  CVE-2022-36324Aug 10, 2022SiemensEPSS 1.8%

  Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.

• 7.2 High severity

  RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2022-36323Aug 10, 2022SiemensEPSS 1.93%

  Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.

• 9.8 Critical severity

  RUGGEDCOM RM1224 LTE(4G) EU: Improper Control of Generation of Code

  CVE-2022-34821Jul 12, 2022SiemensEPSS 2.48%

  A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2), SCALANCE M812-1 ADSL-Router (6GK

• 7.5 High severity

  OpenSSL: Loop with Unreachable Exit Condition

  CVE-2022-0778Mar 15, 2022OpenSSLEPSS 73.2%

  The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or ex