Resource Allocation in Siemens RUGGEDCOM Allocation of Resources Without Limits or Throttling (CVE-2023-39269)

high Tenable OT Security Plugin ID 504807

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The web server of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause total loss of availability of the web server, which might recover after the attack is over.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens released updates for several affected products and recommends updating to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not or are not currently available:

- Update to V4.3.8 or later versions.
- RUGGEDCOM i800: Update to V4.3.8 or later versions.
- RUGGEDCOM i800NC: Update to V4.3.8 or later versions.
- RUGGEDCOM i801: Update to V4.3.8 or later versions.
- RUGGEDCOM i801NC: Update to V4.3.8 or later versions.
- RUGGEDCOM i802: Update to V4.3.8 or later versions.
- RUGGEDCOM i802NC: Update to V4.3.8 or later versions.
- RUGGEDCOM i803: Update to V4.3.8 or later versions.
- RUGGEDCOM i803NC: Update to V4.3.8 or later versions.
- RUGGEDCOM M2100: Update to V4.3.8 or later versions.
- RUGGEDCOM M2100F: Currently no fix is planned.
- RUGGEDCOM M2100NC: Update to V4.3.8 or later versions.
- RUGGEDCOM M2200: Update to V4.3.8 or later versions.
- RUGGEDCOM M2200F: Currently no fix is planned.
- RUGGEDCOM M2200NC: Update to V4.3.8 or later versions.
- RUGGEDCOM M969: Update to V4.3.8 or later versions.
- RUGGEDCOM M969F: Currently no fix is planned.
- RUGGEDCOM M969NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RMC30: Update to V4.3.8 or later versions.
- RUGGEDCOM RMC30NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RMC8388 V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RMC8388 V5.X: Currently no fix is available.
- RUGGEDCOM RMC8388NC V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RMC8388NC V5.X: Currently no fix is available.
- RUGGEDCOM RP110: Update to V4.3.8 or later versions.
- RUGGEDCOM RP110NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS1600: Update to V4.3.8 or later versions.
- RUGGEDCOM RS1600F: Update to V4.3.8 or later versions.
- RUGGEDCOM RS1600FNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS1600NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS1600T: Update to V4.3.8 or later versions.
- RUGGEDCOM RS1600TNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS400: Update to V4.3.8 or later versions.
- RUGGEDCOM RS400F: Currently no fix is planned.
- RUGGEDCOM RS400NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS401: Update to V4.3.8 or later versions.
- RUGGEDCOM RS401NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS416: Update to V4.3.8 or later versions.
- RUGGEDCOM RS416F: Currently no fix is planned.
- RUGGEDCOM RS416NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS416NC v2: Currently no fix is available.
- RUGGEDCOM RS416P: Update to V4.3.8 or later versions.
- RUGGEDCOM RS416PF: Currently no fix is planned.
- RUGGEDCOM RS416PNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS416PNC v2: Currently no fix is available.
- RUGGEDCOM RS416Pv2: Currently no fix is available.
- RUGGEDCOM RS416v2: Currently no fix is available.
- RUGGEDCOM RS8000: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000A: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000ANC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000H: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000HNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000T: Update to V4.3.8 or later versions.
- RUGGEDCOM RS8000TNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900 (32M) V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900 (32M) V5.X: Currently no fix is available.
- RUGGEDCOM RS900F: Currently no fix is planned.
- RUGGEDCOM RS900G: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900G (32M) V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900G (32M) V5.X: Currently no fix is available.
- RUGGEDCOM RS900GF: Currently no fix is planned.
- RUGGEDCOM RS900GNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900GNC(32M) V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900GNC(32M) V5.X: Currently no fix is available.
- RUGGEDCOM RS900GP: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900GPF: Currently no fix is planned.
- RUGGEDCOM RS900GPNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900L: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900LNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900M-GETS-C01: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900M-GETS-XX: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900M-STND-C01: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900M-STND-XX: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900MNC-GETS-C01: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900MNC-GETS-XX: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900MNC-STND-XX: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900MNC-STND-XX-C01: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900NC(32M) V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RS900NC(32M) V5.X: Currently no fix is available.
- RUGGEDCOM RS900W: Update to V4.3.8 or later versions.
- RUGGEDCOM RS910: Update to V4.3.8 or later versions.
- RUGGEDCOM RS910L: Update to V4.3.8 or later versions.
- RUGGEDCOM RS910LNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS910NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS910W: Update to V4.3.8 or later versions.
- RUGGEDCOM RS920L: Update to V4.3.8 or later versions.
- RUGGEDCOM RS920LNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS920W: Update to V4.3.8 or later versions.
- RUGGEDCOM RS930L: Update to V4.3.8 or later versions.
- RUGGEDCOM RS930LNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS930W: Update to V4.3.8 or later versions.
- RUGGEDCOM RS940G: Update to V4.3.8 or later versions.
- RUGGEDCOM RS940GF: Currently no fix is planned.
- RUGGEDCOM RS940GNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RS969: Update to V4.3.8 or later versions.
- RUGGEDCOM RS969NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2100: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2100 (32M) V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2100 (32M) V5.X: Currently no fix is available.
- RUGGEDCOM RSG2100F: Currently no fix is planned.
- RUGGEDCOM RSG2100NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2100NC(32M) V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2100NC(32M) V5.X: Currently no fix is available.
- RUGGEDCOM RSG2100P: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2100PF: Currently no fix is planned.
- RUGGEDCOM RSG2100PNC: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2200: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2200F: Currently no fix is planned.
- RUGGEDCOM RSG2200NC: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2288 V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2288 V5.X: Currently no fix is available.
- RUGGEDCOM RSG2288NC V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2288NC V5.X: Currently no fix is available.
- RUGGEDCOM RSG2300 V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2300 V5.X: Currently no fix is available.
- RUGGEDCOM RSG2300F: Currently no fix is planned.
- RUGGEDCOM RSG2300NC V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2300NC V5.X: Currently no fix is available.
- RUGGEDCOM RSG2300P V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2300P V5.X: Currently no fix is available.
- RUGGEDCOM RSG2300PF: Currently no fix is planned.
- RUGGEDCOM RSG2300PNC V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2300PNC V5.X: Currently no fix is available.
- RUGGEDCOM RSG2488 V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2488 V5.X: Currently no fix is available.
- RUGGEDCOM RSG2488F: Currently no fix is planned.
- RUGGEDCOM RSG2488NC V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG2488NC V5.X: Currently no fix is available.
- RUGGEDCOM RSG907R: Currently no fix is available.
- RUGGEDCOM RSG908C: Currently no fix is available.
- RUGGEDCOM RSG909R: Currently no fix is available.
- RUGGEDCOM RSG910C: Currently no fix is available.
- RUGGEDCOM RSG920P V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG920P V5.X: Currently no fix is available.
- RUGGEDCOM RSG920PNC V4.X: Update to V4.3.8 or later versions.
- RUGGEDCOM RSG920PNC V5.X: Currently no fix is available.
- RUGGEDCOM RSL910: Currently no fix is available.
- RUGGEDCOM RSL910NC: Currently no fix is available.
- RUGGEDCOM RST2228: Currently no fix is available.
- RUGGEDCOM RST2228P: Currently no fix is available.
- RUGGEDCOM RST916C: Currently no fix is available.
- RUGGEDCOM RST916P: Currently no fix is available.
- Restrict access to Port 80/tcp and 443/tcp to trusted IP addresses only.
- Deactivate the webserver if not required and if the product supports deactivation.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens' operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-770902 in HTML and CSAF.

Plugin Details

Severity: High

ID: 504807

File Name: tenable_ot_siemens_CVE-2023-39269.nasl

Version: 1.2

Type: remote

Family: Tenable.ot

Published: 11/18/2025

Updated: 2/14/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/o:siemens:ruggedcom_m969f_firmware, cpe:/o:siemens:ruggedcom_rs416_firmware, cpe:/o:siemens:ruggedcom_rsg2288_firmware:v5, cpe:/o:siemens:ruggedcom_rs940gnc_firmware, cpe:/o:siemens:ruggedcom_m969nc_firmware, cpe:/o:siemens:ruggedcom_rst916p_firmware, cpe:/o:siemens:ruggedcom_rs900gpnc_firmware, cpe:/o:siemens:ruggedcom_rsg2100pnc_%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_rs900m-stnd-xx_firmware, cpe:/o:siemens:ruggedcom_rs920w_firmware, cpe:/o:siemens:ruggedcom_rsg907r_firmware, cpe:/o:siemens:ruggedcom_rs900mnc-gets-xx_firmware, cpe:/o:siemens:ruggedcom_rs900nc%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_i802_firmware, cpe:/o:siemens:ruggedcom_i803_firmware, cpe:/o:siemens:ruggedcom_rs416pv2_firmware:v5, cpe:/o:siemens:ruggedcom_rs1600tnc_firmware, cpe:/o:siemens:ruggedcom_rs900gnc%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_rsg2300f_firmware, cpe:/o:siemens:ruggedcom_rs900mnc-stnd-xx_firmware, cpe:/o:siemens:ruggedcom_m2200_firmware, cpe:/o:siemens:ruggedcom_rs910_firmware, cpe:/o:siemens:ruggedcom_rsg920pnc_firmware:v5, cpe:/o:siemens:ruggedcom_rs900_%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_rsg2100p_%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_i803nc_firmware, cpe:/o:siemens:ruggedcom_rsg2100nc_firmware, cpe:/o:siemens:ruggedcom_rsg2300pf_firmware, cpe:/o:siemens:ruggedcom_rs900w_firmware, cpe:/o:siemens:ruggedcom_rs416v2_firmware:v5, cpe:/o:siemens:ruggedcom_rs920lnc_firmware, cpe:/o:siemens:ruggedcom_rsg2300_firmware:v4, cpe:/o:siemens:ruggedcom_rsg2488nc_firmware:v5, cpe:/o:siemens:ruggedcom_rs400nc_firmware, cpe:/o:siemens:ruggedcom_rmc30_firmware, cpe:/o:siemens:ruggedcom_rmc8388nc_firmware:v5, cpe:/o:siemens:ruggedcom_rs910lnc_firmware, cpe:/o:siemens:ruggedcom_rsg2288_firmware:v4, cpe:/o:siemens:ruggedcom_rs400f_firmware, cpe:/o:siemens:ruggedcom_rs400_firmware, cpe:/o:siemens:ruggedcom_rsg2288nc_firmware:v4, cpe:/o:siemens:ruggedcom_rsg2100f_firmware, cpe:/o:siemens:ruggedcom_rsg2100nc%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_m2100_firmware, cpe:/o:siemens:ruggedcom_rst2228p_firmware, cpe:/o:siemens:ruggedcom_rs900l_firmware, cpe:/o:siemens:ruggedcom_rs416ncv2_firmware:v4, cpe:/o:siemens:ruggedcom_rs8000t_firmware, cpe:/o:siemens:ruggedcom_rst916c_firmware, cpe:/o:siemens:ruggedcom_rs900m-gets-c01_firmware, cpe:/o:siemens:ruggedcom_rsg2100p_%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_m2100f_firmware, cpe:/o:siemens:ruggedcom_rsg2100_firmware, cpe:/o:siemens:ruggedcom_rst2228_firmware, cpe:/o:siemens:ruggedcom_rsg2200_firmware, cpe:/o:siemens:ruggedcom_rsg909r_firmware, cpe:/o:siemens:ruggedcom_i801_firmware, cpe:/o:siemens:ruggedcom_rs8000tnc_firmware, cpe:/o:siemens:ruggedcom_rs969_firmware, cpe:/o:siemens:ruggedcom_rs910l_firmware, cpe:/o:siemens:ruggedcom_rs930l_firmware, cpe:/o:siemens:ruggedcom_rsg920p_firmware:v4, cpe:/o:siemens:ruggedcom_rsg2300_firmware:v5, cpe:/o:siemens:ruggedcom_rs8000nc_firmware, cpe:/o:siemens:ruggedcom_rsg2488_firmware:v4, cpe:/o:siemens:ruggedcom_rs416ncv2_firmware:v5, cpe:/o:siemens:ruggedcom_rs900mnc-gets-c01_firmware, cpe:/o:siemens:ruggedcom_rs1600t_firmware, cpe:/o:siemens:ruggedcom_rsg920pnc_firmware:v4, cpe:/o:siemens:ruggedcom_rs8000a_firmware, cpe:/o:siemens:ruggedcom_rs900mnc-stnd-xx-c01_firmware, cpe:/o:siemens:ruggedcom_rsg2488_firmware:v5, cpe:/o:siemens:ruggedcom_rmc8388nc_firmware:v4, cpe:/o:siemens:ruggedcom_rsg2100_%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_rs8000h_firmware, cpe:/o:siemens:ruggedcom_rs900m-gets-xx_firmware, cpe:/o:siemens:ruggedcom_i802nc_firmware, cpe:/o:siemens:ruggedcom_i801nc_firmware, cpe:/o:siemens:ruggedcom_rs416pncv2_firmware:v4, cpe:/o:siemens:ruggedcom_rs920l_firmware, cpe:/o:siemens:ruggedcom_rsg2288nc_firmware:v5, cpe:/o:siemens:ruggedcom_rs940g_firmware, cpe:/o:siemens:ruggedcom_rs8000hnc_firmware, cpe:/o:siemens:ruggedcom_m969_firmware, cpe:/o:siemens:ruggedcom_rs900g_firmware, cpe:/o:siemens:ruggedcom_rsg2488nc_firmware:v4, cpe:/o:siemens:ruggedcom_rs900m-stnd-c01_firmware, cpe:/o:siemens:ruggedcom_rs416f_firmware, cpe:/o:siemens:ruggedcom_rsg2300nc_firmware:v5, cpe:/o:siemens:ruggedcom_rs1600nc_firmware, cpe:/o:siemens:ruggedcom_rsg2300pnc_firmware:v4, cpe:/o:siemens:ruggedcom_m2200nc_firmware, cpe:/o:siemens:ruggedcom_rs930w_firmware, cpe:/o:siemens:ruggedcom_rs900gf_firmware, cpe:/o:siemens:ruggedcom_rsg2100p_firmware, cpe:/o:siemens:ruggedcom_rs930lnc_firmware, cpe:/o:siemens:ruggedcom_rsg2200f_firmware, cpe:/o:siemens:ruggedcom_rmc30nc_firmware, cpe:/o:siemens:ruggedcom_i800nc_firmware, cpe:/o:siemens:ruggedcom_rs900_firmware, cpe:/o:siemens:ruggedcom_m2200f_firmware, cpe:/o:siemens:ruggedcom_rs900_%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_rs1600_firmware, cpe:/o:siemens:ruggedcom_rs900lnc_firmware, cpe:/o:siemens:ruggedcom_rsg2100pnc_firmware, cpe:/o:siemens:ruggedcom_rsg920p_firmware:v5, cpe:/o:siemens:ruggedcom_rsg2200nc_firmware, cpe:/o:siemens:ruggedcom_rs900gnc%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_rs900gp_firmware, cpe:/o:siemens:ruggedcom_rsg2300nc_firmware:v4, cpe:/o:siemens:ruggedcom_rsg2100nc%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_rsg2300pnc_firmware:v5, cpe:/o:siemens:ruggedcom_i800_firmware, cpe:/o:siemens:ruggedcom_rs900g_%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_rs401_firmware, cpe:/o:siemens:ruggedcom_rmc8388_firmware:v5, cpe:/o:siemens:ruggedcom_rsg910c_firmware, cpe:/o:siemens:ruggedcom_rsg2100pnc_%2832m%29_firmware:v5, cpe:/o:siemens:ruggedcom_rs900gpf_firmware, cpe:/o:siemens:ruggedcom_rs416pv2_firmware:v4, cpe:/o:siemens:ruggedcom_rs910w_firmware, cpe:/o:siemens:ruggedcom_rsg2300p_firmware:v5, cpe:/o:siemens:ruggedcom_rs940gf_firmware, cpe:/o:siemens:ruggedcom_rs416pncv2_firmware:v5, cpe:/o:siemens:ruggedcom_rs416p_firmware, cpe:/o:siemens:ruggedcom_rsg2300p_firmware:v4, cpe:/o:siemens:ruggedcom_rs910nc_firmware, cpe:/o:siemens:ruggedcom_rs900gnc_firmware, cpe:/o:siemens:ruggedcom_rs416pf_firmware, cpe:/o:siemens:ruggedcom_rsg2488f_firmware, cpe:/o:siemens:ruggedcom_rsg908c_firmware, cpe:/o:siemens:ruggedcom_rmc8388_firmware:v4, cpe:/o:siemens:ruggedcom_rsg2100pf_firmware, cpe:/o:siemens:ruggedcom_rsg2100_%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_rs900f_firmware, cpe:/o:siemens:ruggedcom_rs8000_firmware, cpe:/o:siemens:ruggedcom_rs1600fnc_firmware, cpe:/o:siemens:ruggedcom_rs969nc_firmware, cpe:/o:siemens:ruggedcom_rs416v2_firmware:v4, cpe:/o:siemens:ruggedcom_rs8000anc_firmware, cpe:/o:siemens:ruggedcom_m2100nc_firmware, cpe:/o:siemens:ruggedcom_rs900g_%2832m%29_firmware:v4, cpe:/o:siemens:ruggedcom_rs900nc_firmware, cpe:/o:siemens:ruggedcom_rs416nc_firmware, cpe:/o:siemens:ruggedcom_rs401nc_firmware, cpe:/o:siemens:ruggedcom_rs416pnc_firmware, cpe:/o:siemens:ruggedcom_rs1600f_firmware, cpe:/o:siemens:ruggedcom_rs900nc%2832m%29_firmware:v4

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 8/8/2023

Vulnerability Publication Date: 8/8/2023

Reference Information

CVE: CVE-2023-39269

CWE: 770

Detections

Analytics