-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 # SSA-787941: Denial of Service Vulnerability in RUGGEDCOM ROS devices Publication Date: 2022-11-08 Last Update: 2023-11-14 Current Version: 1.4 CVSS v3.1 Base Score: 5.3 SUMMARY ======= RUGGEDCOM ROS-based devices are vulnerable to a denial of service attack (Slowloris). By sending partial HTTP requests nonstop, with none completed, the affected web servers will be waiting for the completion of each request, occupying all available HTTP connections. The web server recovers by itself once the attack ends. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. AFFECTED PRODUCTS AND SOLUTION ============================== * RUGGEDCOM i800 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM i800NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM i801 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM i801NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM i802 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM i802NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM i803 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM i803NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM M969 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM M969F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM M969NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM M2100 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM M2100F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM M2100NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM M2200 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM M2200F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM M2200NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RMC30 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RMC30NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RMC8388 V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RMC8388 V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RMC8388NC V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RMC8388NC V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RP110 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RP110NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS400 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS400F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS400NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS401 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS401NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS416F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416NCv2 V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416NCv2 V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416P - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS416PF - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416PNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416PNCv2 V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416PNCv2 V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS416Pv2 V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS416Pv2 V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RS416v2 V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS416v2 V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RS900 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900 (32M) V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900 (32M) V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RS900F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900G - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900G (32M) V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900G (32M) V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RS900GF - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900GNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900GNC(32M) V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900GNC(32M) V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900GP - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900GPF - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900GPNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900L - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900LNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900M-GETS-C01 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900M-GETS-XX - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900M-STND-C01 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900M-STND-XX - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS900MNC-GETS-C01 - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900MNC-GETS-XX - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900MNC-STND-XX - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900MNC-STND-XX-C01 - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900NC(32M) V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900NC(32M) V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS900W - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS910 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS910L - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS910LNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS910NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS910W - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS920L - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS920LNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS920W - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS930L - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS930LNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS930W - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS940G - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS940GF - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS940GNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS969 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS969NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS1600 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS1600F - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS1600FNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS1600NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS1600T - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS1600TNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS8000 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS8000A - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS8000ANC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS8000H - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS8000HNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS8000NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RS8000T - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RS8000TNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG907R - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG908C - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG909R - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG910C - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG920P V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG920P V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG920PNC V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG920PNC V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2100 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2100 (32M) V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2100 (32M) V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG2100F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2100NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2100NC(32M) V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2100NC(32M) V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2100P - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2100PF - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2100PNC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2200 - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2200F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2200NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2288 V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2288 V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG2288NC V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2288NC V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2300 V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2300 V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG2300F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2300NC V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2300NC V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2300P V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2300P V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG2300PF - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2300PNC V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2300PNC V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2488 V4.X - Affected versions: All versions < V4.3.8 - Remediation: Update to V4.3.8 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109816735/ * RUGGEDCOM RSG2488 V5.X - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSG2488F - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2488NC V4.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSG2488NC V5.X - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RSL910 - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RSL910NC - Affected versions: All versions - Remediation: Currently no fix is planned See recommendations from section "Workarounds and Mitigations" * RUGGEDCOM RST916C - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RST916P - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RST2228 - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ * RUGGEDCOM RST2228P - Affected versions: All versions < V5.6.0 - Remediation: Update to V5.6.0 or later version See further recommendations from section "Workarounds and Mitigations" - Download: https://support.industry.siemens.com/cs/ww/en/view/109806156/ WORKAROUNDS AND MITIGATIONS =========================== Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk: * Restrict access to port 80/tcp and 443/tcp to trusted IP addresses only * Deactivate the webserver if not required, and if deactivation is supported by the product Product-specific remediations or mitigations can be found in the section "Affected Products and Solution". Please follow the "General Security Recommendations". GENERAL SECURITY RECOMMENDATIONS ================================ As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial- security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity PRODUCT DESCRIPTION =================== RUGGEDCOM ROS-based devices, typically switches and serial-to-Ethernet devices, are used to connect devices that operate in harsh environments such as electric utility substations and traffic control cabinets. VULNERABILITY CLASSIFICATION ============================ The vulnerability classification has been performed by using the CVSS scoring system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS environmental score is specific to the customer's environment and will impact the overall CVSS score. The environmental score should therefore be individually defined by the customer to accomplish final scoring. An additional classification has been performed using the CWE classification, a community-developed list of common software security weaknesses. This serves as a common language and as a baseline for weakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found at: https://cwe.mitre.org/. * Vulnerability CVE-2022-39158 Affected devices improperly handle partial HTTP requests which makes them vulnerable to slowloris attacks. This could allow a remote attacker to create a denial of service condition that persists until the attack ends. CVSS v3.1 Base Score: 5.3 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C CWE: CWE-400: Uncontrolled Resource Consumption ADDITIONAL INFORMATION ====================== For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories HISTORY DATA ============ V1.0 (2022-11-08): Publication Date V1.1 (2023-03-14): Added missing affected products. Added fix to multiple products (V4.3.8) V1.2 (2023-04-11): Added multiple missing affected products with no fix currently planned V1.3 (2023-09-12): Added missing affected products with fix planned: RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RS416NC v2, RUGGEDCOM RS416PNC v2, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910NC V1.4 (2023-11-14): Added missing affected products: RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416PNCv2 V4.x, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416Pv2 V4.X. Adjusted the name of RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416PNCv2 V5.x, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS416Pv2 V5.X (added reference to V5.X). Added RUGGEDCOM ROS V5.X products and respective fix (V5.6.0). Adjusted title and summary. Added "No fix planned" for NC products TERMS OF USE ============ Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use. Copyright: Siemens 2023 -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEch+g+vCfo0skv7l6x5aGHHWng/oFAmVSuIAACgkQx5aGHHWn g/pR4xAAvzFUSht3w7yxJsZO/KrDD/SON/6H0aQ9NlgL4IYDgqXP3GfmsNq80kOT yuK1mKi80tNwrnR8agpMIgUX8sv+N13WwR4xGoUuQJlHBgw9r/9pVRAdX6jqFWO0 mo7A7QS5+fwLtrtZT/f/ZauDEJT2XhTe6StVQI1waF+/IQsgWCOdtCRc7vNVFOtp gIuRhd65BB9XeJARA1uTRIsZogYdjJvLVvKbc/Vxg5kzItAfHZlfBHHwTX+LHDpw ARHJ/H0LeWNFuh0gHCq/S8SrVe+EU1z0I2IOaPV8YN1baE8tNOBgjvtX5oUT65i3 uSFr3QhF0shTSfCR4HT8gZIGJnX+P5lAlMsD3f8daQfzjUNW92AV8QBte80GU7fC bBIbkJKBByzP57ZFv7R55zD8DmW6oflmfu7oDvNh/MA+GPFKXXzkBDQlaK/zmGUg ITj+UjHngdZgoIjgVRXQPJcRw6+CZsd/5PNbp+Bf4e7myspcDZKnzOs9TFrrrY1W tc8Dre2YMyGJmUy04FOZxdmUg3e2rnmf0Xurk0rsaWJXGzzjfBkqc6LF/H34NKmm X/tUaoL1Gqk/kwI8CByWMWQlGwGJdA6naUXnf6wdSvIVTYJS1rXX0OMEfQTh+HxT sbwvKWAxoKKbwNI9LAbzalqDup9XtiLFnbb523OiSxiiqxx2neQ= =4XBh -----END PGP SIGNATURE-----