Siemens fixes 11 RUGGEDCOM CROSSBOW vulnerabilities

Siemens has released RUGGEDCOM CROSSBOW version 6.0 to fix 11 vulnerabilities that affect earlier releases. According to a CISA advisory that republishes Siemens ProductCERT's report, an authenticated attacker could use the flaws to run arbitrary SQL commands on the database, retrieve administrative credentials for internal systems, raise privileges, change system configurations, or cause a denial of service. ^[1]

The most severe issues carry a CVSS 3.1 base score of 8.8. They include SQL injection in facility names processed during bulk import and export, in notification condition values, and in uploaded firmware file names. Another 8.8 issue is an authorization bypass through user-controlled keys that exposes administrative credentials for internal systems. ^[1]

Other SQL injection flaws affect custom file labels and device group or facility names processed during bulk export, with CVSS scores of 6.7 and 7.5. Separate authorization problems let a low-privileged user disconnect other users' sessions, retrieve system-wide information about devices, substations, users and scheduled activities, and read, change or delete subnet configurations. Those issues score 6.5, 4.3 and 5.4 respectively. ^[1]

Two client-side enforcement weaknesses, each scored 6.3, allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices and to retry, stop or delete scheduled tasks. ^[1]

Siemens reported the vulnerabilities to CISA and recommends updating to version 6.0 or later. The affected software is deployed worldwide in critical manufacturing, transportation, energy, healthcare, financial services and government facilities, the advisory notes. CISA advises organizations to minimize network exposure for control system devices, keep them off the internet, and use firewalls and VPNs where remote access is required. The advisory also recommends locating control system networks behind firewalls and isolating them from business networks, and it points to CISA's practices for defense-in-depth and ICS security. Organizations that observe suspected malicious activity should report it to CISA for tracking and correlation. ^[1]