CVE-2017-2682

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site Request Forgery (CSRF) attack, potentially allowing an attacker to execute administrative operations, provided the targeted user has an active session and is induced to trigger a malicious request.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	RUGGEDCOM NMS All versions < V2.1 (Windows and Linux)	RUGGEDCOM NMS All versions < V2.1 (Windows and Linux)

References

http://www.securityfocus.com/bid/96458Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037958
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-363881.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-059-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/96458Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037958
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-363881.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-059-01Third Party Advisory, US Government Resource

Timeline

Published: Feb 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26838.2A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-Sit CVE-2017-26849.0Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access CVE-2017-26857.4Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and CVE-2017-26866.5Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the we CVE-2017-26876.1Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cr CVE-2017-26888.8The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with t CVE-2017-26898.8Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to o CVE-2017-26905.5SoftCo with software V200R003C20,eSpace U1910 with software V200R003C00, V200R003C20 and V200R003C30,eSpace U1911 with software V200R003C20,CVE-2017-26916.8Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, version CVE-2017-26927.8The Keyguard application in ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,AL CVE-2017-26937.8ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier ve CVE-2017-26943.3The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any thir