Vulnerability in Siemens Ruggedcom Rugged Operating System
CVE-2012-1803
RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session.
Vulnerability class: POODLE (CVE-2014-3566)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 8.5 (High). Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.490 (98.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.494 · newest: 0.490 · change: -0.004
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.wired.com/threatlevel/2012/04/ruggedcom-backdoor/ (Third Party Advisory)
- www.exploit-db.com/exploits/18779 (Exploit, VDB Entry, Third Party Advisory, exploit)
- exchange.xforce.ibmcloud.com/vulnerabilities/75120 (VDB Entry, Third Party Advisory, vdb-entry)
- www.kb.cert.org/vuls/id/889195 (US Government Resource, Third Party Advisory, third-party-advisory)
- archives.neohapsis.com/archives/bugtraq/2012-04/0186.html (mailing-list, Broken Link)
- www.ruggedcom.com/productbulletin/ros-security-page/ (Broken Link, Vendor Advisory)
- www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-116-01A.pdf (US Government Resource, Third Party Advisory, Broken Link)
- www.kb.cert.org/vuls/id/MAPG-8RCPEN (US Government Resource, Third Party Advisory)
- seclists.org/fulldisclosure/2012/Apr/277 (mailing-list, Exploit, Mailing List, Third Party Advisory)
- ics-cert.us-cert.gov/advisories/ICSA-12-146-01A (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2012-1803?
- CVE-2012-1803 is a vulnerability in Siemens Ruggedcom Rugged Operating System, classified under Cryptographic Issues. Published 2012-04-28.
- Is CVE-2012-1803 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.