CVE-2025-23384A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G)…

6.3MediumCVSS base score
0.28%Exploitation in 30 daysEPSS · top 80% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.2.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.2.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.2.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.2.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.2.1), SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1) (All versions < V8.2.1), SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.2.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.2.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.2.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.2.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.2.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.2.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.2.1), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.2). Affected devices improperly validate usernames during OpenVPN authentication. This could allow an attacker to get partial invalid usernames accepted by the server.

Timeline

2025
15 Jan 2025
15 Jan 2025
ID reserved
By siemens
11 Mar 202555 days later
11 Mar 2025· 55 days later
Published
2026
12 May 202614 months later
12 May 2026· 14 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-23384, by who scored it
Scored by	CVSS	Score	Vector
siemensCNA (assigner)	4.0	Medium6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
siemensCNA (assigner)	3.1	Low3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
NVDNVD · Deferred	4.0	Medium6.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.28% · top 80% of all CVEs (13 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Affected products

Siemens · RUGGEDCOM RM1224 LTE(4G) EU
- affected < V8.2.1
Siemens · RUGGEDCOM RM1224 LTE(4G) NAM
- affected < V8.2.1
Siemens · SCALANCE M804PB
- affected < V8.2.1
Siemens · SCALANCE M812-1 ADSL-Router family
- affected < V8.2.1
Siemens · SCALANCE M816-1 ADSL-Router family
- affected < V8.2.1
Siemens · SCALANCE M826-2 SHDSL-Router
- affected < V8.2.1
Siemens · SCALANCE M874-2
- affected < V8.2.1
Siemens · SCALANCE M874-3
- affected < V8.2.1
Siemens · SCALANCE M874-3 3G-Router (CN)
- affected < V8.2.1
Siemens · SCALANCE M876-3
- affected < V8.2.1
Siemens · SCALANCE M876-3 (ROK)
- affected < V8.2.1
Siemens · SCALANCE M876-4
- affected < V8.2.1
Siemens · SCALANCE M876-4 (EU)
- affected < V8.2.1
Siemens · SCALANCE M876-4 (NAM)
- affected < V8.2.1
Siemens · SCALANCE MUB852-1 (A1)
- affected < V8.2.1
Siemens · SCALANCE MUB852-1 (B1)
- affected < V8.2.1
Siemens · SCALANCE MUM853-1 (A1)
- affected < V8.2.1
Siemens · SCALANCE MUM853-1 (B1)
- affected < V8.2.1
Siemens · SCALANCE MUM853-1 (EU)
- affected < V8.2.1
Siemens · SCALANCE MUM856-1 (A1)
- affected < V8.2.1
Siemens · SCALANCE MUM856-1 (B1)
- affected < V8.2.1
Siemens · SCALANCE MUM856-1 (CN)
- affected < V8.2.1
Siemens · SCALANCE MUM856-1 (EU)
- affected < V8.2.1
Siemens · SCALANCE MUM856-1 (RoW)
- affected < V8.2.1
Siemens · SCALANCE S615 EEC LAN-Router
- affected < V8.2.1
Siemens · SCALANCE S615 LAN-Router
- affected < V8.2.1
Siemens · SCALANCE SC622-2C
- affected < V3.2
Siemens · SCALANCE SC626-2C
- affected < V3.2
Siemens · SCALANCE SC632-2C
- affected < V3.2
Siemens · SCALANCE SC636-2C
- affected < V3.2
Siemens · SCALANCE SC642-2C
- affected < V3.2
Siemens · SCALANCE SC646-2C
- affected < V3.2

References1

https://cert-portal.siemens.com/productcert/html/ssa-280834.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-23384](https://cveledger.app/badge/CVE-2025-23384.svg)](https://cveledger.app/cve/CVE-2025-23384)

Record last updated 12 May 2026, 08:20 UTC.