Skip to content
Fencer Intel
medium 4.3

CVE-2012-4698 json

Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2…

published 2012-12-23 13 y ago modified 2026-06-16 4 mo ago also EUVD-2012-4623

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication, which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic by leveraging the availability of these keys within ROS files at all customer installations.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-12-354-01A updated cvss 9.3

Ruggedcom ROS Hard-Coded RSA SSL Private Key

  • Siemens ROX I OS firmware used by RX1000 and RX1100 series products. ROX I <=ROX_v1.14.5 Siemens ROX II OS firmware used by RX5000 and RX1500 series products. ROX II <=ROX_v2.3.0 Siemens Rugged OS <=3.11 Siemens RuggedMax Operating System Firmware used by the Win7000 and Win7200 base station units and the Win5100 and Win5200 subscriber (CPE) devices <=4.2.1.4621.22
    affected: mitigation “For the HTTPS access, a temporary solution exists with the current version of firmware to disable HTTPS access. For details on this procedure please contact the RuggedCom Customer Support Team.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.