CVE-2023-27462

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en RUGGEDCOM CROSSBOW (Todas las versiones anteriores a V5.3). El gestor de consultas del cliente de la aplicación afectada no verifica los permisos adecuados para consultas de lectura específicas. Esto podría permitir a atacantes remotos autenticados acceder a datos para los que no están autorizados.

Information

Published : 2023-03-14 10:15

Updated : 2026-10-23 23:10

NVD link : CVE-2023-27462

Mitre link : CVE-2023-27462

CVE.ORG link : CVE-2023-27462

JSON object : View

Products Affected

siemens

ruggedcom_crossbow

CWE

CWE-862

Missing Authorization

{"id": "CVE-2023-27462", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-27462", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-27T15:59:39.445388Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "RUGGEDCOM CROSSBOW", "versions": [{"status": "affected", "version": "All versions < V5.3"}], "defaultStatus": "unknown"}]}], "published": "2023-03-14T10:15:29.677", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-320629.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails to check for proper permissions for specific read queries. This could allow authenticated remote attackers to access data they are not authorized for."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en RUGGEDCOM CROSSBOW (Todas las versiones anteriores a V5.3). El gestor de consultas del cliente de la aplicaci\u00f3n afectada no verifica los permisos adecuados para consultas de lectura espec\u00edficas. Esto podr\u00eda permitir a atacantes remotos autenticados acceder a datos para los que no est\u00e1n autorizados."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:ruggedcom_crossbow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2CBB4F0-C72F-4816-94A2-782AFEEE8AD8", "versionEndExcluding": "5.3"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}