This vulnerability (CVE-2026-41918) affects Siemens RUGGEDCOM RST2428P devices (all versions before V4.0). When an authenticated user modifies specific configurations via the web interface, sensitive information is stored insecurely in the browser cache. An attacker with authenticated access and the ability to interact with the user interface could potentially access this cached sensitive data. The CVSS 3.1 base score is 5.7 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, indicating network attack vector, low complexity, required privileges, and user interaction, with high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently available from Siemens.

The vulnerability allows an authenticated attacker to access sensitive information stored in the browser cache due to improper handling of sensitive data during configuration changes. This could lead to unauthorized disclosure of sensitive configuration data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is released, limit authenticated access to trusted users only and avoid modifying configurations from untrusted or shared devices where browser cache could be accessed by others. Consider clearing browser cache after configuration changes as a temporary mitigation.