CVE-2012-4698 Hardcoded credentials in n/a
Hardcoded SSL and SSH keys in Siemens RuggedCom devices allow attackers to decrypt traffic and spoof servers via man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-4698?
CVE-2012-4698 is a medium-severity vulnerability in n/a, published on 23 Dec 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication, which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic by leveraging the availability of these keys within ROS files at all customer installations.
Weakness: CWE-200
Which versions are affected by CVE-2012-4698?
It affects 4 products.
Products include Siemens Ros, Siemens Rox I Os, Siemens Rox Ii Os, Siemens Ruggedmax Os.
How do I fix CVE-2012-4698?
No fix has been published for CVE-2012-4698 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-4698 being exploited?
There is no known exploitation of CVE-2012-4698 in the wild and no public exploit code.
Sources
Also known as GHSA-gxfj-phf9-56vw.