CVE-2023-36748: siemens ruggedcom_rox_mx5000_firmware Inadequate Encryption Strength

Vulnerability summary

CVE-2023-36748 is a medium (CVSS 6.8) Inadequate Encryption Strength vulnerability in siemens ruggedcom_rox_mx5000_firmware. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.3% of scored vulnerabilities.

Timeline

1. 11-07-2023
   PublishedVulnerability first disclosed.
2. 27-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The affected devices are configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over to and from the affected device.

• CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.