CVE-2024-38278

Description

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900GNC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300P V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG907R (All versions < V5.9.0), RUGGEDCOM RSG908C (All versions < V5.9.0), RUGGEDCOM RSG909R (All versions < V5.9.0), RUGGEDCOM RSG910C (All versions < V5.9.0), RUGGEDCOM RSG920P V5.X (All versions < V5.9.0), RUGGEDCOM RSG920PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSL910 (All versions < V5.9.0), RUGGEDCOM RSL910NC (All versions < V5.9.0), RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0), RUGGEDCOM RST916C (All versions < V5.9.0), RUGGEDCOM RST916P (All versions < V5.9.0). The affected products with IP forwarding enabled wrongly make available certain remote services in non-managed VLANs, even if these services are not intentionally activated. An attacker could leverage this vulnerability to create a remote shell to the affected system.

Category

7.5
CVSS
Severity: High
CVSS 4.0 •
CVSS 3.1 •
EPSS 0.13%
Affected: Siemens RUGGEDCOM RMC8388 V5.X
Affected: Siemens RUGGEDCOM RMC8388NC V5.X
Affected: Siemens RUGGEDCOM RS416NCv2 V5.X
Affected: Siemens RUGGEDCOM RS416PNCv2 V5.X
Affected: Siemens RUGGEDCOM RS416Pv2 V5.X
Affected: Siemens RUGGEDCOM RS416v2 V5.X
Affected: Siemens RUGGEDCOM RS900 (32M) V5.X
Affected: Siemens RUGGEDCOM RS900G (32M) V5.X
Affected: Siemens RUGGEDCOM RS900GNC(32M) V5.X
Affected: Siemens RUGGEDCOM RS900NC(32M) V5.X
Affected: Siemens RUGGEDCOM RSG2100 (32M) V5.X
Affected: Siemens RUGGEDCOM RSG2100NC(32M) V5.X
Affected: Siemens RUGGEDCOM RSG2288 V5.X
Affected: Siemens RUGGEDCOM RSG2288NC V5.X
Affected: Siemens RUGGEDCOM RSG2300 V5.X
Affected: Siemens RUGGEDCOM RSG2300NC V5.X
Affected: Siemens RUGGEDCOM RSG2300P V5.X
Affected: Siemens RUGGEDCOM RSG2300PNC V5.X
Affected: Siemens RUGGEDCOM RSG2488 V5.X
Affected: Siemens RUGGEDCOM RSG2488NC V5.X
Affected: Siemens RUGGEDCOM RSG907R
Affected: Siemens RUGGEDCOM RSG908C
Affected: Siemens RUGGEDCOM RSG909R
Affected: Siemens RUGGEDCOM RSG910C
Affected: Siemens RUGGEDCOM RSG920P V5.X
Affected: Siemens RUGGEDCOM RSG920PNC V5.X
Affected: Siemens RUGGEDCOM RSL910
Affected: Siemens RUGGEDCOM RSL910NC
Affected: Siemens RUGGEDCOM RST2228
Affected: Siemens RUGGEDCOM RST2228P
Affected: Siemens RUGGEDCOM RST916C
Affected: Siemens RUGGEDCOM RST916P
Published at:
Updated at:

References

Link Tags
https://cert-portal.siemens.com/productcert/html/ssa-170375.html

Frequently Asked Questions

What is the severity of CVE-2024-38278?
CVE-2024-38278 has been scored as a high severity vulnerability.
How to fix CVE-2024-38278?
To fix CVE-2024-38278, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-38278 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-38278 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-38278?
CVE-2024-38278 affects Siemens RUGGEDCOM RMC8388 V5.X, Siemens RUGGEDCOM RMC8388NC V5.X, Siemens RUGGEDCOM RS416NCv2 V5.X, Siemens RUGGEDCOM RS416PNCv2 V5.X, Siemens RUGGEDCOM RS416Pv2 V5.X, Siemens RUGGEDCOM RS416v2 V5.X, Siemens RUGGEDCOM RS900 (32M) V5.X, Siemens RUGGEDCOM RS900G (32M) V5.X, Siemens RUGGEDCOM RS900GNC(32M) V5.X, Siemens RUGGEDCOM RS900NC(32M) V5.X, Siemens RUGGEDCOM RSG2100 (32M) V5.X, Siemens RUGGEDCOM RSG2100NC(32M) V5.X, Siemens RUGGEDCOM RSG2288 V5.X, Siemens RUGGEDCOM RSG2288NC V5.X, Siemens RUGGEDCOM RSG2300 V5.X, Siemens RUGGEDCOM RSG2300NC V5.X, Siemens RUGGEDCOM RSG2300P V5.X, Siemens RUGGEDCOM RSG2300PNC V5.X, Siemens RUGGEDCOM RSG2488 V5.X, Siemens RUGGEDCOM RSG2488NC V5.X, Siemens RUGGEDCOM RSG907R, Siemens RUGGEDCOM RSG908C, Siemens RUGGEDCOM RSG909R, Siemens RUGGEDCOM RSG910C, Siemens RUGGEDCOM RSG920P V5.X, Siemens RUGGEDCOM RSG920PNC V5.X, Siemens RUGGEDCOM RSL910, Siemens RUGGEDCOM RSL910NC, Siemens RUGGEDCOM RST2228, Siemens RUGGEDCOM RST2228P, Siemens RUGGEDCOM RST916C, Siemens RUGGEDCOM RST916P.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.