CVE-2021-37175 : A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices do not properly handle permissions to traverse the file system. If exploited, an attacker could gain access to an overview of the complete file system on the affected devices.

Published 2021-09-14 11:15:25

Updated 2022-10-27 12:58:47

Source Siemens AG

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-37175

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 36 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-37175

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2021-37175

CWE-280 Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Assigned by: productcert@siemens.com (Secondary)

CWE-755 Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2021-37175

Siemens » Ruggedcom Rox Mx5000 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Mx5000 » Version: N/A
Siemens » Ruggedcom Rox Rx1400 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1400 » Version: N/A
Siemens » Ruggedcom Rox Rx1500 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1500 » Version: N/A
Siemens » Ruggedcom Rox Rx1501 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1501 » Version: N/A
Siemens » Ruggedcom Rox Rx1510 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1510 » Version: N/A
Siemens » Ruggedcom Rox Rx1511 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1511 » Version: N/A
Siemens » Ruggedcom Rox Rx1512 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1512 » Version: N/A
Siemens » Ruggedcom Rox Rx5000 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx5000 » Version: N/A
Siemens » Ruggedcom Rox Rx1524 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1524_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1524 » Version: N/A
Siemens » Ruggedcom Rox Rx1536 Firmware
Versions before (<) 2.14.1
cpe:2.3:o:siemens:ruggedcom_rox_rx1536_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Rox Rx1536 » Version: N/A

Vulnerability Details : CVE-2021-37175

Exploit prediction scoring system (EPSS) score for CVE-2021-37175

CVSS scores for CVE-2021-37175

CWE ids for CVE-2021-37175

References for CVE-2021-37175

Products affected by CVE-2021-37175