RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, ROX RX5000 (wszystkie wersje < V2.16.0) vulnerabilities
9 known CVE vulnerabilities in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, ROX RX5000 (wszystkie wersje < V2.16.0), translated and rated.
- CVE-2023-36754Critical
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The SCEP server configuration URL parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
- CVE-2023-36753Critical
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 devices in versions below V2.16.0. The uninstall-app App-name parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
- CVE-2023-36752Critical
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 (all versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation.
- CVE-2023-36751Critical
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 (all versions < V2.16.0). The install-app URL parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
- CVE-2023-36750Critical
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The software-upgrade Url parameter in the web interface is vulnerable to command injection due to missing server side input sanitation.
- CVE-2023-36749High
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 devices running versions below V2.16.0. The webserver of the affected devices supports the insecure TLS 1.0 protocol.
- CVE-2023-36748Medium
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The affected devices are configured to offer weak ciphers by default, which could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over to and from the affected device.
- CVE-2023-36390High
A reflected XSS vulnerability has been identified in the web interface of RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 devices in versions below 2.16.0. An attacker could exploit this vulnerability to execute malicious JavaScript code by tricking users into clicking a malicious link.
- CVE-2023-36386High
A reflected XSS vulnerability has been identified in the web interface of RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 devices in versions below 2.16.0. An attacker could exploit this vulnerability to execute malicious JavaScript code by tricking users into clicking a malicious link.