CVE-2023-52238

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-09 · updated 2026-06-17
Weakness: CWE-200

Description

A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0). The web server of the affected systems leaks the MACSEC key in clear text to a logged in user. An attacker with the credentials of a low privileged user could retrieve the MACSEC key and access (decrypt) the ethernet frames sent by authorized recipients.

Affected products

Siemens RUGGEDCOM RST2228: before V5.9.0 — fixed in V5.9.0
Siemens RUGGEDCOM RST2228P: before V5.9.0 — fixed in V5.9.0

How to fix

Upgrade to a fixed version: Siemens RUGGEDCOM RST2228 V5.9.0; Siemens RUGGEDCOM RST2228P V5.9.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-52238 or the next vulnerability affects your stack