CVE-2017-12736: Input Validation
A vulnerability has been identified in RUGGEDCOM ROS for RSL910 devices (All versions < ROS V5.0.1), RUGGEDCOM ROS for all other devices (All versions < ROS V4.3.4), SCALANCE XB-200/XC-200/XP-200/XR300-WG (All versions between V3.0 (including) and V3.0.2 (excluding)), SCALANCE XR-500/XM-400 (All versions between V6.1 (including) and V6.1.1 (excluding)). After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to writeto the device under certain conditions, potentially allowing users located in the adjacentnetwork of the targeted device to perform unauthorized administrative actions.
Other sources
After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an attacker located in the adjacent network of the targeted device to perform unauthorized administrative actions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2017-12736.
Which devices are affected by this vulnerability?
RUGGEDCOM ROS for RSL910 devices (All versions < ROS V5.0.1), RUGGEDCOM ROS for all other devices (All versions < ROS V4.3.4), SCALANCE XB-200/XC-200/XP-200/XR300-WG (All versions between V3.0 (including) and V3.0.2 (excluding)), SCALANCE XR-500/XM-400 (All versions between V6.1 (including) and V6.1.2 (excluding)).
What is the severity of CVE-2017-12736?
The severity of CVE-2017-12736 is high with a severity score of 8.8.
What is the Common Weakness Enumeration (CWE) ID for this vulnerability?
The Common Weakness Enumeration (CWE) ID for CVE-2017-12736 is CWE-665 and CWE-20.
Where can I find more information about CVE-2017-12736?
You can find more information about CVE-2017-12736 at the following references: [http://www.securityfocus.com/bid/101041](http://www.securityfocus.com/bid/101041), [http://www.securitytracker.com/id/1039463](http://www.securitytracker.com/id/1039463), [http://www.securitytracker.com/id/1039464](http://www.securitytracker.com/id/1039464).