VulnerabilityModified
CVE-2015-5537
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different…
MEDIUM 4.3EPSS 1.14%
Does this matter?
Lower severity and a low EPSS score (1.14%). Track it; it rarely justifies an emergency change on its own.
Description
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-312
- Affected
- siemens/ruggedcom rox ii firmware · siemens/ruggedcom rugged operating system
- Source
- cve@mitre.org
References
- http://www.securitytracker.com/id/1033022Broken Link, Third Party Advisory, VDB Entry
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-396873.pdfBroken Link, Patch, Vendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03ABroken Link, Third Party Advisory, US Government Resource
- http://www.securitytracker.com/id/1033022Broken Link, Third Party Advisory, VDB Entry
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-396873.pdfBroken Link, Patch, Vendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03ABroken Link, Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.