CVE-2024-39675

State: Published
Severity: 8.7 High
Published: Jul 9, 2024
Updated: Aug 27, 2025
Reserved: Jun 27, 2024

Description

A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110 (All versions < V4.3.10), RUGGEDCOM RP110NC (All versions < V4.3.10), RUGGEDCOM RS400 (All versions < V4.3.10), RUGGEDCOM RS400NC (All versions < V4.3.10), RUGGEDCOM RS401 (All versions < V4.3.10), RUGGEDCOM RS401NC (All versions < V4.3.10), RUGGEDCOM RS416 (All versions < V4.3.10), RUGGEDCOM RS416NC (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416P (All versions < V4.3.10), RUGGEDCOM RS416PNC (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V4.X (All versions < V4.3.10), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS910 (All versions < V4.3.10), RUGGEDCOM RS910L (All versions), RUGGEDCOM RS910LNC (All versions), RUGGEDCOM RS910NC (All versions < V4.3.10), RUGGEDCOM RS910W (All versions < V4.3.10), RUGGEDCOM RS920L (All versions), RUGGEDCOM RS920LNC (All versions), RUGGEDCOM RS920W (All versions). In some configurations the affected products wrongly enable the Modbus service in non-managed VLANS. Only serial devices are affected by this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	siemens
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

Product	Versions
RUGGEDCOM RMC30Siemens	before V4.3.10Affected
RUGGEDCOM RMC30NCSiemens	before V4.3.10Affected
RUGGEDCOM RP110Siemens	before V4.3.10Affected
RUGGEDCOM RP110NCSiemens	before V4.3.10Affected
RUGGEDCOM RS400Siemens	before V4.3.10Affected
RUGGEDCOM RS400NCSiemens	before V4.3.10Affected
RUGGEDCOM RS401Siemens	before V4.3.10Affected
RUGGEDCOM RS401NCSiemens	before V4.3.10Affected
RUGGEDCOM RS416Siemens	before V4.3.10Affected
RUGGEDCOM RS416NCSiemens	before V4.3.10Affected
RUGGEDCOM RS416NCv2 V4.XSiemens	before V4.3.10Affected
RUGGEDCOM RS416NCv2 V5.XSiemens	before V5.9.0Affected
RUGGEDCOM RS416PSiemens	before V4.3.10Affected
RUGGEDCOM RS416PNCSiemens	before V4.3.10Affected
RUGGEDCOM RS416PNCv2 V4.XSiemens	before V4.3.10Affected
RUGGEDCOM RS416PNCv2 V5.XSiemens	before V5.9.0Affected
RUGGEDCOM RS416Pv2 V4.XSiemens	before V4.3.10Affected
RUGGEDCOM RS416Pv2 V5.XSiemens	before V5.9.0Affected
RUGGEDCOM RS416v2 V4.XSiemens	before V4.3.10Affected
RUGGEDCOM RS416v2 V5.XSiemens	before V5.9.0Affected
RUGGEDCOM RS910Siemens	before V4.3.10Affected
RUGGEDCOM RS910LSiemens	all versionsAffected
RUGGEDCOM RS910LNCSiemens	all versionsAffected
RUGGEDCOM RS910NCSiemens	before V4.3.10Affected
RUGGEDCOM RS910WSiemens	before V4.3.10Affected
RUGGEDCOM RS920LSiemens	all versionsAffected
RUGGEDCOM RS920LNCSiemens	all versionsAffected
RUGGEDCOM RS920WSiemens	all versionsAffected

References

https://cert-portal.siemens.com/productcert/html/ssa-170375.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.