Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Exploit-DB RSS Feed

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2024-23327 is a high-severity vulnerability affecting Envoy Proxy, a widely used high-performance edge, middle, and service proxy that facilitates service mesh and API gateway functionalities. The vulnerability arises from a NULL pointer dereference (CWE-476) when Proxy Protocol version 2 (PPv2) is enabled both on a listener and the subsequent cluster. Specifically, if a downstream request has a command type of LOCAL but lacks the protocol block, Envoy attempts to craft an upstream PPv2 header using a NULL pointer, causing the Envoy process to segfault and crash. This results in a denial of service (DoS) condition, impacting availability. The issue affects multiple versions of Envoy: all versions from 1.26.0 up to but not including 1.26.7, 1.27.0 up to 1.27.3, 1.28.0 up to 1.28.1, and 1.29.0 up to 1.29.1. The vulnerability does not require authentication or user interaction and can be triggered remotely by sending crafted requests that meet the described conditions. No known exploits are currently reported in the wild, but the vulnerability is rated with a CVSS v3.1 score of 7.5 (High), reflecting its potential to cause service disruption. The issue has been addressed in patched releases 1.26.7, 1.27.3, 1.28.1, and 1.29.1, and users are strongly advised to upgrade to these versions. No effective workarounds exist, making patching the primary mitigation strategy.

Detailed information about CVE-2024-23327: CWE-476: NULL Pointer Dereference in envoyproxy envoy affecting envoyproxy envoy. Get real-time updates, technical de

CVE-2024-23327: CWE-476: NULL Pointer Dereference in envoyproxy envoy - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-23327: CWE-476: NULL Pointer Dereference in envoyproxy envoy

A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/roles/check.php of the component User Selector. The manipulation of the argument ID Number leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component.

CVE-2024-3931 is a cross-site scripting (XSS) vulnerability identified in Totara LMS, a widely used learning management system, affecting versions up to 18.7. The vulnerability resides in the admin/roles/check.php file within the User Selector component. Specifically, it involves improper sanitization of the 'ID Number' argument, which can be manipulated by an attacker to inject malicious scripts. This flaw allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser when they access a crafted URL or interface element. The attack can be launched remotely without requiring authentication, although some privileges (low-level) may be necessary, and it requires user interaction to trigger the malicious payload. The vulnerability has been publicly disclosed, increasing the risk of exploitation. Totara has addressed this issue in versions 13.46, 14.38, 15.33, 16.27, 17.21, and 18.8, and upgrading to these versions or later is recommended to mitigate the risk. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the moderate impact on confidentiality and integrity, limited impact on availability, and the need for user interaction and low privileges for exploitation. No known exploits in the wild have been reported yet, but public disclosure means attackers may develop exploits soon. The vulnerability primarily threatens the confidentiality and integrity of user sessions and data within Totara LMS environments, potentially enabling session hijacking, phishing, or unauthorized actions within the LMS interface.

Detailed information about CVE-2024-3931: Cross Site Scripting in Totara LMS affecting Totara LMS. Get real-time updates, technical details, and mitigation stra

CVE-2024-3931: Cross Site Scripting in Totara LMS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-3931: Cross Site Scripting in Totara LMS

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'Log Viewers' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute the 'tail' command with root privileges and disclose contents of all files in the filesystem.

CVE-2025-40591 is a high-severity vulnerability affecting multiple Siemens RUGGEDCOM ROX series devices, including the MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 models running firmware versions prior to V2.16.5. The vulnerability stems from improper security enforcement where client-side controls are relied upon instead of robust server-side input validation, classified under CWE-602 (Client-Side Enforcement of Server-Side Security). Specifically, the 'Log Viewers' tool in the web interface of these devices fails to sanitize user input on the server side, allowing an authenticated remote attacker to inject commands. This flaw enables execution of the Unix 'tail' command with root privileges, which can be exploited to read arbitrary files across the device's filesystem. Since the attacker must be authenticated but no user interaction is required beyond that, the vulnerability presents a significant risk of confidentiality breach without affecting system integrity or availability. The CVSS 3.1 base score is 7.7 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change due to potential access to sensitive data beyond the initial component. No known exploits are currently reported in the wild, and no patches have been linked yet, indicating a need for immediate attention from affected organizations. Given the critical role of RUGGEDCOM devices in industrial and critical infrastructure networks, this vulnerability could be leveraged to gather sensitive operational data or facilitate further attacks within the network environment.

Detailed information about CVE-2025-40591: CWE-602: Client-Side Enforcement of Server-Side Security in Siemens RUGGEDCOM ROX MX5000 affecting Siemens RUGGEDCOM 

CVE-2025-40591: CWE-602: Client-Side Enforcement of Server-Side Security in Siemens RUGGEDCOM ROX MX5000 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40591: CWE-602: Client-Side Enforcement of Server-Side Security in Siemens RUGGEDCOM ROX MX5000

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.

CVE-2025-48937 is an authentication bypass vulnerability identified in the matrix-rust-sdk, a Rust implementation of the Matrix client-server communication library. Specifically, the vulnerability exists in the matrix-sdk-crypto component versions from 0.8.0 up to but not including 0.11.1. The flaw arises because the SDK does not properly validate the sender of encrypted events. This means that a malicious homeserver operator can tamper with events delivered to clients, causing these events to appear as if they originated from a different user than the actual sender. This spoofing undermines the integrity of message authentication within the Matrix protocol, potentially allowing attackers to impersonate other users without their credentials. The vulnerability does not impact confidentiality or availability directly but compromises message integrity and user trust. Exploitation requires the attacker to control or operate the homeserver, which implies a high privilege requirement (PR:H). No user interaction is needed for exploitation, and the attack can be conducted remotely over the network (AV:N). The issue was publicly disclosed on June 10, 2025, and fixed in versions 0.11.1 and 0.12.0 of the SDK. There are no known exploits in the wild at the time of this report. The CVSS v3.1 base score is 4.9, reflecting a medium severity level, primarily due to the high privilege requirement and the impact limited to integrity without affecting confidentiality or availability.

Detailed information about CVE-2025-48937: CWE-290: Authentication Bypass by Spoofing in matrix-org matrix-rust-sdk affecting matrix-org matrix-rust-sdk. Get re

CVE-2025-48937: CWE-290: Authentication Bypass by Spoofing in matrix-org matrix-rust-sdk - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48937: CWE-290: Authentication Bypass by Spoofing in matrix-org matrix-rust-sdk

HMAS Canberra accidentally blocks wireless internet and radio services in New Zealand

Source: https://www.rnz.co.nz/news/world/563357/hmas-canberra-accidentally-blocks-wireless-internet-and-radio-services-in-new-zealand

The incident involving HMAS Canberra, an Australian Navy vessel, accidentally blocking wireless internet and radio services in New Zealand represents a unique case of unintended electromagnetic interference or jamming caused by military operations. According to the report sourced from RNZ and discussed briefly on Reddit's NetSec community, the vessel's activities disrupted local wireless communications and radio services. While specific technical details are scarce, such interference typically arises from the use of high-powered radar systems, communication jammers, or electronic warfare equipment onboard military ships. These systems can emit signals that unintentionally overlap with civilian frequency bands, causing degradation or complete loss of service for wireless internet and radio users in the affected area. The disruption was accidental, indicating a lack of proper coordination or frequency management between the military operations and civilian spectrum users. No known exploits or vulnerabilities were involved, and this is not a cyberattack but rather an operational interference event. The incident highlights the risks posed by military electromagnetic emissions to civilian communication infrastructure, especially in geographically proximate regions. It also underscores the importance of spectrum deconfliction and real-time coordination between defense forces and civilian authorities to prevent such service outages. Given the minimal discussion and low Reddit score, the event appears isolated without broader exploitation or ongoing threat activity. However, the impact on communication availability during the interference period was significant for affected users in New Zealand.

Detailed information about HMAS Canberra accidentally blocks wireless internet and radio services in New Zealand. Get real-time updates, technical details, and 

HMAS Canberra accidentally blocks wireless internet and radio services in New Zealand - Live Threat Intelligence - Threat Radar | OffSeq.com

HMAS Canberra accidentally blocks wireless internet and radio services in New Zealand

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2022-46700 is a high-severity memory corruption vulnerability affecting Apple tvOS and related Apple operating systems, including Safari 16.2, macOS Ventura 13.1, iOS 15.7.2, iPadOS 15.7.2, iOS 16.2, iPadOS 16.2, and watchOS 9.2. The vulnerability arises from insufficient input validation when processing maliciously crafted web content, which can lead to arbitrary code execution. Specifically, this is a type of heap-based buffer overflow or use-after-free vulnerability classified under CWE-787 (Out-of-bounds Write). An attacker could exploit this flaw by convincing a user to visit a specially crafted web page or load malicious content in Safari or on a device running the affected tvOS version. Successful exploitation would allow the attacker to execute arbitrary code with the privileges of the Safari process or the affected application, potentially leading to full system compromise. The CVSS v3.1 base score of 8.8 reflects the vulnerability's critical impact, with network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The vulnerability affects multiple Apple platforms, but the focus here is on tvOS, Apple's operating system for Apple TV devices. Although no known exploits in the wild have been reported at the time of disclosure, the severity and ease of exploitation make timely patching essential. Apple addressed this vulnerability in tvOS 16.2 and corresponding updates for other platforms by improving input validation to prevent memory corruption. The vulnerability's root cause is typical of memory safety issues in complex web content processing engines, highlighting the ongoing risk posed by web-based attack vectors on embedded and consumer devices like Apple TV.

Detailed information about CVE-2022-46700: Processing maliciously crafted web content may lead to arbitrary code execution in Apple tvOS affecting Apple tvOS. G

CVE-2022-46700: Processing maliciously crafted web content may lead to arbitrary code execution in Apple tvOS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-46700: Processing maliciously crafted web content may lead to arbitrary code execution in Apple tvOS

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2022-46699 is a high-severity vulnerability affecting Apple tvOS, specifically related to the processing of maliciously crafted web content. The underlying technical issue is a memory corruption flaw categorized under CWE-787 (Out-of-bounds Write). This vulnerability arises due to improper state management during the handling of web content, which can be exploited to achieve arbitrary code execution. The vulnerability affects multiple Apple platforms, including Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2, iPadOS 16.2, and watchOS 9.2, with the root cause being addressed in these versions through improved state management. The CVSS v3.1 base score is 8.8, indicating a high level of severity. The attack vector is network-based (AV:N), requiring no privileges (PR:N), but user interaction is necessary (UI:R). The impact scope is unchanged (S:U), but the confidentiality, integrity, and availability impacts are all high (C:H/I:H/A:H). Exploitation involves tricking a user into processing malicious web content, which could be delivered via compromised or malicious websites or embedded web content in apps. Successful exploitation could allow attackers to execute arbitrary code with the privileges of the affected process, potentially leading to full device compromise. No known exploits in the wild have been reported to date. The vulnerability is mitigated by updating to the patched versions of the affected Apple operating systems and Safari browser. Given the broad usage of Apple devices in consumer and enterprise environments, this vulnerability poses a significant risk, especially where tvOS devices are deployed in corporate or public settings.

Detailed information about CVE-2022-46699: Processing maliciously crafted web content may lead to arbitrary code execution in Apple tvOS affecting Apple tvOS. G

CVE-2022-46699: Processing maliciously crafted web content may lead to arbitrary code execution in Apple tvOS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-46699: Processing maliciously crafted web content may lead to arbitrary code execution in Apple tvOS

Affected devices improperly handle partial HTTP requests which makes them vulnerable to slowloris attacks. 

This could allow a remote attacker to create a denial of service condition that persists until the attack ends.

CVE-2022-39158 is a medium-severity vulnerability affecting Siemens RUGGEDCOM i800 devices, specifically all versions prior to V4.3.8. The vulnerability arises from improper handling of partial HTTP requests, which exposes the device to slowloris-style denial of service (DoS) attacks. Slowloris attacks work by opening multiple HTTP connections to the target device and sending partial requests very slowly, thereby exhausting the device's resources such as connection slots, memory, or processing capacity. Because the RUGGEDCOM i800 does not adequately manage or limit these partial HTTP requests, an attacker can maintain many half-open connections, preventing legitimate users from accessing the device or its services. This uncontrolled resource consumption aligns with CWE-400, indicating a failure to properly restrict resource usage. The vulnerability persists as long as the attack continues, potentially causing prolonged service disruption. Although no known exploits have been reported in the wild, the vulnerability was publicly disclosed on September 13, 2022, and Siemens has released version 4.3.8 as a patched update. The RUGGEDCOM i800 is an industrial networking device commonly used in critical infrastructure sectors such as energy, transportation, and utilities, where reliable network communication is essential. The vulnerability's exploitation could lead to significant operational disruptions in these environments.

Detailed information about CVE-2022-39158: CWE-400: Uncontrolled Resource Consumption in Siemens RUGGEDCOM i800 affecting Siemens RUGGEDCOM i800. Get real-time 

CVE-2022-39158: CWE-400: Uncontrolled Resource Consumption in Siemens RUGGEDCOM i800 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-39158: CWE-400: Uncontrolled Resource Consumption in Siemens RUGGEDCOM i800

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2), SCALANCE M874-2 (6GK5874-2AA00-2AA2), SCALANCE M874-3 (6GK5874-3AA00-2AA2), SCALANCE M876-3 (6GK5876-3AA02-2BA2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2), SCALANCE M876-4 (6GK5876-4AA10-2BA2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2), SCALANCE SC622-2C (6GK5622-2GS00-2AC2), SCALANCE SC622-2C (6GK5622-2GS00-2AC2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2), SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0), SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0), SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0), SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0), SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0), SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0), SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0), SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0). By injecting code to specific configuration options for OpenVPN, an attacker could execute arbitrary code with elevated privileges.

CVE-2022-34821 is a medium-severity vulnerability affecting multiple Siemens industrial networking devices, including the RUGGEDCOM RM1224 LTE(4G) EU and a broad range of SCALANCE routers and SIMATIC communication processors. The root cause is an improper control of code generation (CWE-94), specifically a code injection vulnerability within the OpenVPN configuration options of these devices. By injecting malicious code into certain OpenVPN configuration parameters, an attacker can execute arbitrary code with elevated privileges on the affected device. This vulnerability arises because the devices do not adequately sanitize or validate user-supplied input in the OpenVPN configuration, allowing crafted payloads to be interpreted and executed by the system. The affected products are widely used in industrial control systems (ICS), critical infrastructure, and manufacturing environments for secure remote access and network segmentation. The vulnerability was publicly disclosed on July 12, 2022, with no known exploits in the wild reported to date. However, the potential for exploitation exists given the elevated privileges gained upon successful injection. The affected devices span multiple product lines and geographic variants, including EU, NAM, US, ME, and RoW versions, indicating a broad attack surface. The lack of available patches at the time of disclosure increases the risk for organizations relying on these devices. Siemens’ networking equipment is commonly deployed in sectors such as energy, transportation, utilities, and industrial automation, making this vulnerability particularly critical for operational technology (OT) environments. Attackers exploiting this flaw could gain control over network routers and communication processors, potentially disrupting network traffic, intercepting sensitive data, or pivoting deeper into industrial networks.

Detailed information about CVE-2022-34821: CWE-94: Improper Control of Generation of Code ('Code Injection') in Siemens RUGGEDCOM RM1224 LTE(4G) EU affecting Si

CVE-2022-34821: CWE-94: Improper Control of Generation of Code ('Code Injection') in Siemens RUGGEDCOM RM1224 LTE(4G) EU - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-34821: CWE-94: Improper Control of Generation of Code ('Code Injection') in Siemens RUGGEDCOM RM1224 LTE(4G) EU

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. Affected devices are vulnerable to a web-based code injection attack via the console.

An attacker could exploit this vulnerability to inject code into the web server and cause malicious behavior in legitimate users accessing certain web resources on the affected
device.

CVE-2022-34663 is a medium severity vulnerability affecting a broad range of Siemens RUGGEDCOM devices, including the i800 series and numerous other models such as the RMC, RS, RSG, RSL, and RST series. These devices are ruggedized industrial network components commonly deployed in critical infrastructure sectors like energy, transportation, and utilities. The vulnerability is classified under CWE-94: Improper Control of Generation of Code, commonly known as code injection. Specifically, the flaw exists in the web-based management console of these devices, where insufficient input validation allows an attacker to inject malicious code into the web server. This injected code can then execute within the context of legitimate users accessing certain web resources on the device, potentially leading to unauthorized actions, data manipulation, or further compromise of the device and network. The vulnerability affects all versions prior to V4.3.8, and no public exploits have been reported in the wild to date. However, the extensive list of affected models and the critical role these devices play in industrial control systems make this a significant concern. The attack vector is web-based, implying that an attacker would need network access to the device's management interface, which may be exposed internally or externally depending on the deployment. The lack of patch links suggests that Siemens may have released updates or mitigations separately, but organizations must verify and apply the latest firmware versions to remediate this issue.

Detailed information about CVE-2022-34663: CWE-94: Improper Control of Generation of Code ('Code Injection') in Siemens RUGGEDCOM i800 affecting Siemens RUGGEDC

CVE-2022-34663: CWE-94: Improper Control of Generation of Code ('Code Injection') in Siemens RUGGEDCOM i800 - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Affecting Norway

Filter Threats

Threats Affecting Norway