CVE-2025-23384

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.2.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.2.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.2.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.2.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.2.1), SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1) (All versions < V8.2.1), SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.2.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.2.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.2.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.2.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.2.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.2.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.2.1), SCALANCE SC-600 family (All versions). Affected devices improperly validate usernames during OpenVPN authentication. This could allow an attacker to get partial invalid usernames accepted by the server.

Scoring

Severity

MEDIUM

CVSS base score

6.3

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.27%

CWE

CWE-187

Published

2025-03-11

Last modified

2026-05-12

Affected products

• Siemens RUGGEDCOM RM1224 LTE(4G) EU
• Siemens RUGGEDCOM RM1224 LTE(4G) NAM
• Siemens SCALANCE M804PB
• Siemens SCALANCE M812-1 ADSL-Router family
• Siemens SCALANCE M816-1 ADSL-Router family
• Siemens SCALANCE M826-2 SHDSL-Router
• Siemens SCALANCE M874-2
• Siemens SCALANCE M874-3

Weakness type

• CWE-187

Related vulnerabilities

• CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
• CVE-2026-84376 — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
• CVE-2026-62750 — Windows HTTP Protocol Stack Tampering Vulnerability
• CVE-2026-14687 — 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
• CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
• CVE-2026-55602 — http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
• CVE-2026-44837 — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
• CVE-2026-35031 — Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

Markdown version · Browse all CVEs