EUVD-2026-33914
GHSA-xpj8-v2g3-x4r2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (siemens) · only source for this CVE.
CVSS VectorVendor: siemens
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0). The affected applications stores sensitive information in the browser cache when an authenticated user modify specific configurations. This could allow an authenticated attacker to access sensitive data stored in the browser.
AnalysisAI
Sensitive configuration data exposure in Siemens RUGGEDCOM RST2428P industrial network switch (all firmware versions before V4.0) allows authenticated attackers to retrieve confidential information from the browser cache. The web management interface fails to enforce proper cache-control directives when an authenticated user performs specific configuration modification workflows, persisting sensitive data in the local browser cache. No public exploit code exists and the vulnerability is not listed in CISA KEV, though the High confidentiality impact (VC:H) on the vulnerable component elevates concern for OT/industrial network environments where configuration data can expose network topology or credentials.
Technical ContextAI
CWE-525 (Use of Web Browser Cache Containing Sensitive Information) describes a class of vulnerabilities where a web application neglects to set HTTP cache-control response headers - such as 'Cache-Control: no-store' or 'Pragma: no-cache' - causing the browser to persist sensitive page content to disk or memory cache. RUGGEDCOM RST2428P (CPE implied from model 6GK6242-6PA00, Siemens RUGGEDCOM product line) is an industrial Ethernet switch designed for ruggedized operational technology (OT) and substation automation environments. Its web-based management interface is the attack surface. The CVSS 4.0 vector specifies AT:P (Attack Requirements: Present), indicating a specific condition - the victim must have actively performed a configuration modification workflow - must be met before sensitive data is cached and accessible. The scope is contained (SC:N/SI:N/SA:N), meaning the vulnerability does not pivot to subsequent systems.
RemediationAI
Upgrade RUGGEDCOM RST2428P firmware to V4.0 or later, as confirmed by Siemens PSIRT via advisory SSA-253495 (https://cert-portal.siemens.com/productcert/html/ssa-253495.html). Until patching is feasible, restrict access to the device's web management interface to dedicated, single-user administrative workstations rather than shared jump servers or terminals - this eliminates the shared-browser-cache attack path. Additionally, enforce a policy requiring administrators to clear browser cache and history after completing configuration sessions on the device's management interface; note this compensating control is procedural and not enforceable by the system. Consider placing the management interface behind a dedicated out-of-band management network with strict access controls to reduce the number of users who could reach the cached data. Disabling the web management interface entirely in favor of CLI-only access (if supported by the device) would eliminate the vulnerable code path, though this may impact operational workflows.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today