CVE-2023-27309

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en RUGGEDCOM CROSSBOW (Todas las versiones anteriores a V5.2). El gestor de consultas del cliente de la aplicación afectada no verifica los permisos adecuados para consultas de escritura específicas. Esto podría permitir a un atacante remoto autenticado realizar acciones no autorizadas.

Information

Published : 2023-03-14 10:15

Updated : 2026-10-24 13:10

NVD link : CVE-2023-27309

Mitre link : CVE-2023-27309

CVE.ORG link : CVE-2023-27309

JSON object : View

Products Affected

siemens

ruggedcom_crossbow

CWE

CWE-862

Missing Authorization

{"id": "CVE-2023-27309", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-27309", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T14:59:44.203179Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "RUGGEDCOM CROSSBOW", "versions": [{"status": "affected", "version": "All versions < V5.2"}], "defaultStatus": "unknown"}]}], "published": "2023-03-14T10:15:28.677", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en RUGGEDCOM CROSSBOW (Todas las versiones anteriores a V5.2). El gestor de consultas del cliente de la aplicaci\u00f3n afectada no verifica los permisos adecuados para consultas de escritura espec\u00edficas. Esto podr\u00eda permitir a un atacante remoto autenticado realizar acciones no autorizadas."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0C5F255-C56D-4F50-BFA1-5FAA4A3856F7", "versionEndExcluding": "5.2"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}