CVE-2022-29561

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
SiemensRUGGEDCOM ROX MX5000All versions < V2.16.0
SiemensRUGGEDCOM ROX MX5000REAll versions < V2.16.0
SiemensRUGGEDCOM ROX RX1400All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1500All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1501All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1510All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1511All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1512All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1524All versions < V2.16.0
SiemensRUGGEDCOM ROX RX1536All versions < V2.16.0
SiemensRUGGEDCOM ROX RX5000All versions < V2.16.0
siemensruggedcom_rox_mx5000< V2.16.0
siemensruggedcom_rox_mx5000re< V2.16.0
siemensruggedcom_rox_rx1400< V2.16.0
siemensruggedcom_rox_rx1500< V2.16.0
siemensruggedcom_rox_rx1501< V2.16.0
siemensruggedcom_rox_rx1510V2.16.0
siemensruggedcom_rox_rx1511V2.16.0
siemensruggedcom_rox_rx1512V2.16.0
siemensruggedcom_rox_rx1524V2.16.0
siemensruggedcom_rox_rx1536V2.16.0
siemensruggedcom_rox_rx5000V2.16.0

References

Timeline

Published
Jul 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-295625.3A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGECVE-2022-295647.5Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrastCVE-2022-295668.1The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values frCVE-2022-295677.5The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.CVE-2022-29579.8A vulnerability classified as critical was found in SourceCodester Simple and Nice Shopping Cart Script. Affected by this vulnerability is aCVE-2022-295776.1OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly eCVE-2022-295785.3Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, addressCVE-2022-29588.8The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions avaCVE-2022-295807.8There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegmenCVE-2022-295817.8Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. TCVE-2022-295827.0In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered byCVE-2022-295837.8service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executa
CVE-2022-29561: High severity, CVSS 8.8 | Vulnix