Scalance M874-3 (Siemens) - vulnerabilities (CVEs)

38 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-05-12. Vendor: Siemens.

CVEs of Scalance M874-3

CVE-2025-40833 - CVSS 8.7 (high), 2026-05-12: The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause…
CVE-2025-15467 - CVSS 9.8 (critical), 2026-01-27: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact…
CVE-2025-23384 - CVSS 6.3 (medium), 2025-03-11: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-50572 - CVSS 8.6 (high), 2024-11-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-50561 - CVSS 6.1 (medium), 2024-11-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-50559 - CVSS 5.1 (medium), 2024-11-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-50558 - CVSS 5.3 (medium), 2024-11-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-50557 - CVSS 9.8 (critical), 2024-11-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-50560 - CVSS 4.3 (medium), 2024-11-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-41978 - CVSS 7.1 (high), 2024-08-13: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-41977 - CVSS 8 (high), 2024-08-13: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-41976 - CVSS 8.8 (high), 2024-08-13: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2024-3596 - CVSS 9 (critical), 2024-07-09: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or…
CVE-2024-26925 - CVSS 7.8 (high), 2024-04-25: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex…
CVE-2024-2511 - CVSS 5.9 (medium), 2024-04-08: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may…
CVE-2023-49692 - CVSS 7.2 (high), 2023-12-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2023-49691 - CVSS 7.2 (high), 2023-12-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2023-44322 - CVSS 5.9 (medium), 2023-11-14: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2023-44374 - CVSS 8.8 (high), 2023-11-14: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2023-44373 - CVSS 9.4 (critical), 2023-11-14: Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or…
CVE-2023-44319 - CVSS 6.9 (medium), 2023-11-14: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2023-44318 - CVSS 6.9 (medium), 2023-11-14: Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated…
CVE-2023-44321 - CVSS 6.5 (medium), 2023-11-14: Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated…
CVE-2023-44317 - CVSS 8.6 (high), 2023-11-14: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2023-44320 - CVSS 4.3 (medium), 2023-11-14: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2022-46143 - CVSS 5.1 (medium), 2022-12-13: Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially…
CVE-2022-46142 - CVSS 5.7 (medium), 2022-12-13: Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the…
CVE-2022-46140 - CVSS 7.1 (high), 2022-12-13: Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file…
CVE-2022-31765 - CVSS 8.8 (high), 2022-10-11: Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their…
CVE-2022-31766 - CVSS 8.6 (high), 2022-10-11: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM…
CVE-2022-36323 - CVSS 9.1 (critical), 2022-08-10: Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or…
CVE-2022-36325 - CVSS 6.8 (medium), 2022-08-10: Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with…
CVE-2022-36324 - CVSS 7.5 (high), 2022-08-10: Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute…
CVE-2022-34821 - CVSS 9.8 (critical), 2022-07-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB…
CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2020-28400 - CVSS 8.7 (high), 2021-07-13: Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered…
CVE-2019-13946 - CVSS 7.5 (high), 2020-02-11: Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are…