A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RU…

published 2024-07-09 2y ago modified 2026-06-17 4mo ago also EUVD-2024-37239

cvss: 6.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGGEDCOM RS416NCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416PNCv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.9.0), RUGGEDCOM RS416v2 V5.X (All versions < V5.9.0), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900GNC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RS900NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100NC(32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2100PNC (32M) V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2288NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300P V5.X (All versions < V5.9.0), RUGGEDCOM RSG2300PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488 V5.X (All versions < V5.9.0), RUGGEDCOM RSG2488NC V5.X (All versions < V5.9.0), RUGGEDCOM RSG907R (All versions < V5.9.0), RUGGEDCOM RSG908C (All versions < V5.9.0), RUGGEDCOM RSG909R (All versions < V5.9.0), RUGGEDCOM RSG910C (All versions < V5.9.0), RUGGEDCOM RSG920P V5.X (All versions < V5.9.0), RUGGEDCOM RSG920PNC V5.X (All versions < V5.9.0), RUGGEDCOM RSL910 (All versions < V5.9.0), RUGGEDCOM RSL910NC (All versions < V5.9.0), RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0), RUGGEDCOM RST916C (All versions < V5.9.0), RUGGEDCOM RST916P (All versions < V5.9.0). The affected products with IP forwarding enabled wrongly make available certain remote services in non-managed VLANs, even if these services are not intentionally activated. An attacker could leverage this vulnerability to create a remote shell to the affected system.

Patch / fix

fixed in 30

Siemens RUGGEDCOM RMC8388 V5.X V5.9.0
Siemens RUGGEDCOM RMC8388NC V5.X V5.9.0
Siemens RUGGEDCOM RS416NCv2 V5.X V5.9.0
Siemens RUGGEDCOM RS416PNCv2 V5.X V5.9.0
Siemens RUGGEDCOM RS416Pv2 V5.X V5.9.0
Siemens RUGGEDCOM RS416v2 V5.X V5.9.0
Siemens RUGGEDCOM RS900 (32M) V5.X V5.9.0
Siemens RUGGEDCOM RS900G (32M) V5.X V5.9.0
Siemens RUGGEDCOM RS900GNC(32M) V5.X V5.9.0
Siemens RUGGEDCOM RS900NC(32M) V5.X V5.9.0
Siemens RUGGEDCOM RSG2100 (32M) V5.X V5.9.0
Siemens RUGGEDCOM RSG2100NC(32M) V5.X V5.9.0
Siemens RUGGEDCOM RSG2100P (32M) V5.X V5.9.0
Siemens RUGGEDCOM RSG2100PNC (32M) V5.X V5.9.0
Siemens RUGGEDCOM RSG2288 V5.X V5.9.0
Siemens RUGGEDCOM RSG2288NC V5.X V5.9.0
Siemens RUGGEDCOM RSG2300 V5.X V5.9.0
Siemens RUGGEDCOM RSG2300NC V5.X V5.9.0
Siemens RUGGEDCOM RSG2300P V5.X V5.9.0
Siemens RUGGEDCOM RSG2300PNC V5.X V5.9.0
Siemens RUGGEDCOM RSG2488 V5.X V5.9.0
Siemens RUGGEDCOM RSG2488NC V5.X V5.9.0
Siemens RUGGEDCOM RSG907R V5.9.0
Siemens RUGGEDCOM RSG908C V5.9.0
Siemens RUGGEDCOM RSG909R V5.9.0
Siemens RUGGEDCOM RSG910C V5.9.0
Siemens RUGGEDCOM RSG920P V5.X V5.9.0
Siemens RUGGEDCOM RSG920PNC V5.X V5.9.0
Siemens RUGGEDCOM RSL910 V5.9.0
Siemens RUGGEDCOM RSL910NC V5.9.0

Is CVE-2024-38278 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-193-06 updated 2025-08-12 cvss 6.6

Siemens RUGGEDCOM

Siemens RUGGEDCOM RMC8388 V5.X < 5.9.0 Siemens RUGGEDCOM RMC8388NC V5.X < 5.9.0 Siemens RUGGEDCOM RS416NCv2 V5.X < 5.9.0 Siemens RUGGEDCOM RS416PNCv2 V5.X < 5.9.0 Siemens RUGGEDCOM RS416Pv2 V5.X < 5.9.0 Siemens RUGGEDCOM RS416v2 V5.X < 5.9.0

+28 more productsfewer

Siemens RUGGEDCOM RS900 (32M) V5.X < 5.9.0 Siemens RUGGEDCOM RS900G (32M) V5.X < 5.9.0 Siemens RUGGEDCOM RS900GNC(32M) V5.X < 5.9.0 Siemens RUGGEDCOM RS900NC(32M) V5.X < 5.9.0 Siemens RUGGEDCOM RSG907R < 5.9.0 Siemens RUGGEDCOM RSG908C < 5.9.0 Siemens RUGGEDCOM RSG909R < 5.9.0 Siemens RUGGEDCOM RSG910C < 5.9.0 Siemens RUGGEDCOM RSG920P V5.X < 5.9.0 Siemens RUGGEDCOM RSG920PNC V5.X < 5.9.0 Siemens RUGGEDCOM RSG2100 (32M) V5.X < 5.9.0 Siemens RUGGEDCOM RSG2100NC(32M) V5.X < 5.9.0 Siemens RUGGEDCOM RSG2100P (32M) V5.X < 5.9.0 Siemens RUGGEDCOM RSG2100PNC (32M) V5.X < 5.9.0 Siemens RUGGEDCOM RSG2288 V5.X < 5.9.0 Siemens RUGGEDCOM RSG2288NC V5.X < 5.9.0 Siemens RUGGEDCOM RSG2300 V5.X < 5.9.0 Siemens RUGGEDCOM RSG2300NC V5.X < 5.9.0 Siemens RUGGEDCOM RSG2300P V5.X < 5.9.0 Siemens RUGGEDCOM RSG2300PNC V5.X < 5.9.0 Siemens RUGGEDCOM RSG2488 V5.X < 5.9.0 Siemens RUGGEDCOM RSG2488NC V5.X < 5.9.0 Siemens RUGGEDCOM RSL910 < 5.9.0 Siemens RUGGEDCOM RSL910NC < 5.9.0 Siemens RUGGEDCOM RST916C < 5.9.0 Siemens RUGGEDCOM RST916P < 5.9.0 Siemens RUGGEDCOM RST2228 < 5.9.0 Siemens RUGGEDCOM RST2228P < 5.9.0

affected: fixed in V5.9.0, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2y ago (2024-07-24)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA	4.0	7.5	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.5	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Siemens RUGGEDCOM RMC8388 V5.X
Siemens RUGGEDCOM RMC8388NC V5.X
Siemens RUGGEDCOM RS416NCv2 V5.X
Siemens RUGGEDCOM RS416PNCv2 V5.X
Siemens RUGGEDCOM RS416Pv2 V5.X
Siemens RUGGEDCOM RS416v2 V5.X
Siemens RUGGEDCOM RS900 (32M) V5.X
Siemens RUGGEDCOM RS900G (32M) V5.X
Siemens RUGGEDCOM RS900GNC(32M) V5.X
Siemens RUGGEDCOM RS900NC(32M) V5.X
Siemens RUGGEDCOM RSG2100 (32M) V5.X
Siemens RUGGEDCOM RSG2100NC(32M) V5.X
Siemens RUGGEDCOM RSG2100P (32M) V5.X
Siemens RUGGEDCOM RSG2100PNC (32M) V5.X
Siemens RUGGEDCOM RSG2288 V5.X
Siemens RUGGEDCOM RSG2288NC V5.X
Siemens RUGGEDCOM RSG2300 V5.X
Siemens RUGGEDCOM RSG2300NC V5.X
Siemens RUGGEDCOM RSG2300P V5.X
Siemens RUGGEDCOM RSG2300PNC V5.X
Siemens RUGGEDCOM RSG2488 V5.X
Siemens RUGGEDCOM RSG2488NC V5.X
Siemens RUGGEDCOM RSG907R
Siemens RUGGEDCOM RSG908C
Siemens RUGGEDCOM RSG909R
Siemens RUGGEDCOM RSG910C
Siemens RUGGEDCOM RSG920P V5.X
Siemens RUGGEDCOM RSG920PNC V5.X
Siemens RUGGEDCOM RSL910
Siemens RUGGEDCOM RSL910NC
Siemens RUGGEDCOM RST2228
Siemens RUGGEDCOM RST2228P
Siemens RUGGEDCOM RST916C
Siemens RUGGEDCOM RST916P
siemens ruggedcom_ros_rmc8388
siemens ruggedcom_ros_rmc8388nc
siemens ruggedcom_ros_rs416ncv2
siemens ruggedcom_ros_rs416pncv2
siemens ruggedcom_ros_rs416pv2
siemens ruggedcom_ros_rs416v2
siemens ruggedcom_ros_rs900
siemens ruggedcom_ros_rs900g
siemens ruggedcom_ros_rs900gnc
siemens ruggedcom_ros_rs900nc
siemens ruggedcom_ros_rsg2100
siemens ruggedcom_ros_rsg2100nc
siemens ruggedcom_ros_rsg2288
siemens ruggedcom_ros_rsg2288nc
siemens ruggedcom_ros_rsg2300
siemens ruggedcom_ros_rsg2300nc

Classification

Weakness

CWE-266 Incorrect Privilege Assignment

References

cert-portal.siemens.com /productcert/html/ssa-170375.html

Sources

CVE List CVE-2024-38278
NVD CVE-2024-38278

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed