CVE-2024-27943: siemens ruggedcom crossbow External Control of File Name or Path

Vulnerability summary

CVE-2024-27943 is a high (CVSS 7.2) External Control of File Name or Path vulnerability in siemens ruggedcom crossbow. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.1% of scored vulnerabilities.

Timeline

1. 14-05-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code execution.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.