ICSA-19-099-05: ICSA-19-099-05 Siemens RUGGEDCOM ROX II

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2018-5379 · CWE-415

  The shipped version of the Quagga BGP daemon (bgpd) can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. The security vulnerability could be exploited by an attacker spoofing a malicious BGP UPDATE message within the network. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality, integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

• CVE-2018-5380 · CWE-125

  The shipped version of the Quagga BGP daemon (bgpd) can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. The security vulnerability could be exploited by an attacker spoofing a malicious BGP code-point. Successful exploitation requires the attacker to be in the position of a configured, trusted BGP peer. No system privileges and no user interaction is required. An attacker could use the vulnerability to insert binary data into the internal log files. At the time of advisory publication no public exploitation of this security vulnerability was known.

• CVE-2018-5381 · CWE-228

  The shipped version of the Quagga BGP daemon (bgpd) has a bug in its parsing of "Capabilities" in BGP OPEN messages. The parser can enter an infinite loop on invalid capabilities causing a denial of service. The security vulnerability could be exploited by an attacker spoofing a malicious BGP OPEN message. Successful exploitation requires the attacker to be in the position of a configured, trusted BGP peer. No system privileges and no user interaction is required. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Acknowledgments, as the advisory lists them

• Siemens: reported this vulnerability to CISA.

The advisory's legal notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.