Siemens RUGGEDCOM CROSSBOW

Summary:

The document provides a security advisory from Siemens regarding vulnerabilities in their RUGGEDCOM CROSSBOW product. The vulnerabilities, with a CVSS v3 score ranging from 5.3 to 9.8, allow for remote exploitation and can lead to arbitrary code execution, file uploads, and denial-of-service situations.

The affected products are versions prior to V5.5, and the vulnerabilities include missing authorization, improper neutralization of special elements, missing authentication, external control of file names or paths, improper limitation of pathnames, and exposure of sensitive information.

Siemens recommends updating the product to version V5.5 or later, as well as implementing general security measures such as network access control and firewalls. The United States Computer Emergency Readiness Team (US-CERT) also provides guidelines for minimizing the risk of exploitation, including minimizing network exposure, isolating control systems, and using more secure remote access methods.