CVE-2020-28398: Siemens Ruggedcom Rox MX5000

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The CLI feature in the web interface of affected devices is vulnerable to cross-site request forgery (CSRF). This could allow an attacker to read or modify the device configuration by tricking an authenticated legitimate user into accessing a malicious link.

Affected products

  • Siemens Ruggedcom Rox MX5000: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox MX5000RE: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1400: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1500: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1501: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1510: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1511: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1512: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1524: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX1536: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)
  • Siemens Ruggedcom Rox RX5000: before V2.16.0 (fixed in V2.16.0); before 2.16.0 (fixed in 2.16.0)

Published 2024-12-10. Last modified 2026-06-17.