PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-28398 Siemens CVE debrief

A cross-site request forgery (CSRF) vulnerability in the CLI feature of the Siemens RUGGEDCOM ROX II web interface allows attackers to read or modify device configuration by tricking authenticated users into accessing malicious links. The vulnerability carries a HIGH severity CVSS 8.8 score with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The issue was published by CISA on December 10, 2024, with a revision on May 6, 2025 to fix typos. Siemens has released firmware version 2.16.0 or later to address this vulnerability.

Vendor
Siemens
Product
RUGGEDCOM ROX MX5000
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2025-05-06
Advisory published
2024-12-10
Advisory updated
2025-05-06

Who should care

Organizations operating Siemens RUGGEDCOM ROX II industrial networking devices in critical infrastructure environments, including electric utilities, transportation systems, and manufacturing facilities where these ruggedized switches and routers are deployed.

Technical summary

The CLI feature embedded in the web interface of Siemens RUGGEDCOM ROX II devices fails to implement adequate CSRF protections. An attacker can craft malicious links that, when accessed by an authenticated administrator, execute unauthorized commands against the device's CLI interface. This enables reading sensitive configuration data or modifying operational parameters without the attacker's direct access to credentials. The attack requires user interaction (clicking a malicious link) but no authentication bypass, making it suitable for phishing campaigns targeting OT personnel.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor fix: Update affected RUGGEDCOM ROX II devices to firmware version 2.16.0 or later
  • Implement network segmentation to restrict web interface access to authorized management stations
  • Deploy defense-in-depth controls per CISA ICS recommended practices
  • Train operators to verify link authenticity before clicking while authenticated to device web interfaces
  • Monitor for unauthorized configuration changes on affected devices

Evidence notes

The vulnerability description and affected products are derived from CISA CSAF data with Siemens as the canonical vendor source. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C indicates network accessibility, low complexity, no privileges required but user interaction needed, with high impacts across all three security dimensions.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-28398 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-28398

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-28398 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-28398

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-347-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-384652.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-384652.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.