CVE-2015-5537 Weak cryptography in n/a
Man-in-the-middle attackers can decrypt HTTPS traffic from Siemens RuggedCom devices due to improper CBC padding implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-5537?
CVE-2015-5537 is a medium-severity vulnerability in n/a, published on 3 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.
Weakness: CWE-312
Which versions are affected by CVE-2015-5537?
It affects 2 products.
Products include Siemens Ruggedcom Rox Ii Firmware, Siemens Ruggedcom Rugged Operating System.
How do I fix CVE-2015-5537?
No fix has been published for CVE-2015-5537 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-5537 being exploited?
There is no known exploitation of CVE-2015-5537 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-56835 Code injection in RUGGEDCOM ROX MX5000
- CVE-2024-56837 Command injection in RUGGEDCOM ROX MX5000
- CVE-2024-56838 Code injection in RUGGEDCOM ROX MX5000
- CVE-2024-56839 A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGE
- CVE-2024-56836 Command injection in RUGGEDCOM ROX MX5000
Sources
Also known as GHSA-gmxw-f223-9jx2.