Siemens Ruggedcom ROX JSON-RPC Interface Arbitrary File Disclosure Vulnerability

An arbitrary file disclosure vulnerability has been identified in several Ruggedcom ROX products, all versions prior to 2.17.1. The issue arises from improper input validation in the web server's JSON-RPC interface, which could enable an authenticated remote attacker to read arbitrary files from the operating system's filesystem with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the device, potentially allowing for further exploitation or manipulation of the system.

Remediation

Siemens has released new versions for the affected products. Users are advised to update to the latest versions. For general security recommendations, Siemens suggests protecting network access to devices with appropriate measures and following the operational guidelines for Industrial Security.