CVE-2024-56836

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). During the Dynamic DNS configuration of the affected product it is possible to inject additional configuration parameters. Under certain circumstances, an attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
SiemensRUGGEDCOM ROX MX5000< V2.17.0
SiemensRUGGEDCOM ROX MX5000RE< V2.17.0
SiemensRUGGEDCOM ROX RX1400< V2.17.0
SiemensRUGGEDCOM ROX RX1500< V2.17.0
SiemensRUGGEDCOM ROX RX1501< V2.17.0
SiemensRUGGEDCOM ROX RX1510< V2.17.0
SiemensRUGGEDCOM ROX RX1511< V2.17.0
SiemensRUGGEDCOM ROX RX1512< V2.17.0
SiemensRUGGEDCOM ROX RX1524< V2.17.0
SiemensRUGGEDCOM ROX RX1536< V2.17.0
SiemensRUGGEDCOM ROX RX5000< V2.17.0

References

Timeline

Published
Dec 9, 2025
Last modified
Oct 23, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-568377.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGECVE-2024-568387.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGECVE-2024-568397.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGECVE-2024-56848.8An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty CVE-2024-568407.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGECVE-2024-568417.4A vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of the module are vulnerable to LDAP injectionCVE-2024-56858.1Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's membeCVE-2024-56865.4The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribuCVE-2024-56875.3If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been inCVE-2024-56888.1If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability aCVE-2024-568825.4Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permaneCVE-2024-568838.1Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on
CVE-2024-56836: High severity, CVSS 8.8 | Vulnix