CVE-2017-12736

moderate-risk
Published 2017-12-26

After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions.

Do I need to act?

-
0.47% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
ADJACENT_NETWORK / LOW complexity

Affected Products (7)

Scalance Xb-200 Firmware
Scalance Xp-200 Firmware
Scalance Xr300-Wg Firmware
Scalance Xm-400 Firmware
Ruggedcom Ros
Scalance Xc-200 Firmware
Scalance Xr-500 Firmware

Affected Vendors

Siemens

References (9)

Third Party Advisory http://www.securityfocus.com/bid/101041
Third Party Advisory http://www.securitytracker.com/id/1039463
Third Party Advisory http://www.securitytracker.com/id/1039464
https://cert-portal.siemens.com/productcert/html/ssa-856721.html
Issue Tracking https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856721.pdf
Third Party Advisory http://www.securityfocus.com/bid/101041
Third Party Advisory http://www.securitytracker.com/id/1039463
Third Party Advisory http://www.securitytracker.com/id/1039464
Issue Tracking https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856721.pdf
43
/ 100
moderate-risk
Severity 27/34 · High
Exploitability 2/34 · Minimal
Exposure 14/34 · Moderate