High severity · published Oct 11, 2022
CVE-2022-31765
Affected devices do not properly authorize the change password function of the web interface
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
Affected devices do not properly authorize the change password function of the web interface.
This could allow low privileged users to escalate their privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RR
RUGGEDCOM RM1224 LTE(4G) EU · Siemens
before V7.1.2 · source: vendor
RR
RUGGEDCOM RM1224 LTE(4G) NAM · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M804PB · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M812-1 ADSL-Router · Siemens
before V7.1.2; before V7.1.2 · source: vendor
SM
SCALANCE M816-1 ADSL-Router · Siemens
before V7.1.2; before V7.1.2 · source: vendor
SM
SCALANCE M826-2 SHDSL-Router · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M874-2 · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M874-3 · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M876-3 · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M876-3 (ROK) · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M876-4 · Siemens
before V7.1.2 · source: vendor
SM
SCALANCE M876-4 (EU) · Siemens
before V7.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31765
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31765
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-019200.html
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-552702.html
Mitigation
https://cert-portal.siemens.com/productcert/pdf/ssa-552702.pdf
More from RUGGEDCOM RM1224 LTE(4G) EU
9.1
CVE-2022-36323
Affected devices do not properly sanitize an input field
8.8
CVE-2025-15467
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
8.6
CVE-2022-31766
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…
7.5
CVE-2025-40833
The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests
7.5
CVE-2022-36324
Affected devices do not properly handle the renegotiation of SSL/TLS parameters