Skip to content
Fencer Vulns
high 7.5

CVE-2021-42016 json

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, R…

published 2022-03-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-29004

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM RMC30, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RP110, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600T, RUGGEDCOM RS400, RUGGEDCOM RS400F, RUGGEDCOM RS401, RUGGEDCOM RS416, RUGGEDCOM RS416F, RUGGEDCOM RS416P, RUGGEDCOM RS416PF, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000H, RUGGEDCOM RS8000T, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900F, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GF, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPF, RUGGEDCOM RS900L, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GF, RUGGEDCOM RS969, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100F, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PF, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200F, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300F, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PF, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488F, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSL910, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. A timing attack, in a third-party component, could make the retrieval of the private key possible, used for encryption of sensitive data.

If a threat actor were to exploit this, the data integrity and security could be compromised.

Patch / fix

  • Siemens RUGGEDCOM i800 V4.3.8
  • Siemens RUGGEDCOM i801 V4.3.8
  • Siemens RUGGEDCOM i802 V4.3.8
  • Siemens RUGGEDCOM i803 V4.3.8
  • Siemens RUGGEDCOM M2100 V4.3.8
  • Siemens RUGGEDCOM M2200 V4.3.8
  • Siemens RUGGEDCOM M969 V4.3.8
  • Siemens RUGGEDCOM RMC30 V4.3.8
  • Siemens RUGGEDCOM RMC8388 V4.X V4.3.8
  • Siemens RUGGEDCOM RMC8388 V5.X V5.6.0
  • Siemens RUGGEDCOM RP110 V4.3.8
  • Siemens RUGGEDCOM RS1600 V4.3.8
  • Siemens RUGGEDCOM RS1600F V4.3.8
  • Siemens RUGGEDCOM RS1600T V4.3.8
  • Siemens RUGGEDCOM RS400 V4.3.8
  • Siemens RUGGEDCOM RS401 V4.3.8
  • Siemens RUGGEDCOM RS416 V4.3.8
  • Siemens RUGGEDCOM RS416P V4.3.8
  • Siemens RUGGEDCOM RS416Pv2 V4.X V4.3.8
  • Siemens RUGGEDCOM RS416Pv2 V5.X V5.6.0
  • Siemens RUGGEDCOM RS416v2 V4.X V4.3.8
  • Siemens RUGGEDCOM RS416v2 V5.X V5.6.0
  • Siemens RUGGEDCOM RS8000 V4.3.8
  • Siemens RUGGEDCOM RS8000A V4.3.8
  • Siemens RUGGEDCOM RS8000H V4.3.8
  • Siemens RUGGEDCOM RS8000T V4.3.8
  • Siemens RUGGEDCOM RS900 V4.3.8
  • Siemens RUGGEDCOM RS900 (32M) V4.X V4.3.8
  • Siemens RUGGEDCOM RS900 (32M) V5.X V5.6.0
  • Siemens RUGGEDCOM RS900G V4.3.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-069-12 updated cvss 7.5

Siemens RUGGEDCOM ROS

  • Siemens RUGGEDCOM i800 < 4.3.8 Siemens RUGGEDCOM i801 < 4.3.8 Siemens RUGGEDCOM i802 < 4.3.8 Siemens RUGGEDCOM i803 < 4.3.8 Siemens RUGGEDCOM M969 < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM M969F
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM M2100 < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM M2100F
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM M2200 < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM M2200F
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RMC30 < 4.3.8 Siemens RUGGEDCOM RMC8388 V4.X < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RMC8388 V5.X < 5.6.0
    affected: fixed in V5.6.0, mitigation support.industry.siemens.com
show 19 more
  • Siemens RUGGEDCOM RP110 < 4.3.8 Siemens RUGGEDCOM RS400 < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS400F
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RS401 < 4.3.8 Siemens RUGGEDCOM RS416 < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS416F
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RS416P < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS416PF
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RS416Pv2 V4.X < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS416Pv2 V5.X < 5.6.0
    affected: fixed in V5.6.0, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS416v2 V4.X < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS416v2 V5.X < 5.6.0
    affected: fixed in V5.6.0, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS900 < 4.3.8 Siemens RUGGEDCOM RS900 (32M) V4.X < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS900 (32M) V5.X < 5.6.0
    affected: fixed in V5.6.0, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS900F
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RS900G < 4.3.8 Siemens RUGGEDCOM RS900G (32M) V4.X < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS900G (32M) V5.X < 5.6.0
    affected: fixed in V5.6.0, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS900GF
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RS900GP < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com
  • Siemens RUGGEDCOM RS900GPF
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM RS900L < 4.3.8 Siemens RUGGEDCOM RS900M-GETS-C01 < 4.3.8 Siemens RUGGEDCOM RS900M-GETS-XX < 4.3.8 Siemens RUGGEDCOM RS900M-STND-C01 < 4.3.8 Siemens RUGGEDCOM RS900M-STND-XX < 4.3.8
    affected: fixed in V4.3.8, mitigation support.industry.siemens.com

50 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Siemens RUGGEDCOM i800
  • Siemens RUGGEDCOM i801
  • Siemens RUGGEDCOM i802
  • Siemens RUGGEDCOM i803
  • Siemens RUGGEDCOM M2100
  • Siemens RUGGEDCOM M2100F
  • Siemens RUGGEDCOM M2200
  • Siemens RUGGEDCOM M2200F
  • Siemens RUGGEDCOM M969
  • Siemens RUGGEDCOM M969F
  • Siemens RUGGEDCOM RMC30
  • Siemens RUGGEDCOM RMC8388 V4.X
  • Siemens RUGGEDCOM RMC8388 V5.X
  • Siemens RUGGEDCOM RP110
  • Siemens RUGGEDCOM RS1600
  • Siemens RUGGEDCOM RS1600F
  • Siemens RUGGEDCOM RS1600T
  • Siemens RUGGEDCOM RS400
  • Siemens RUGGEDCOM RS400F
  • Siemens RUGGEDCOM RS401
  • Siemens RUGGEDCOM RS416
  • Siemens RUGGEDCOM RS416F
  • Siemens RUGGEDCOM RS416P
  • Siemens RUGGEDCOM RS416PF
  • Siemens RUGGEDCOM RS416Pv2 V4.X
  • Siemens RUGGEDCOM RS416Pv2 V5.X
  • Siemens RUGGEDCOM RS416v2 V4.X
  • Siemens RUGGEDCOM RS416v2 V5.X
  • Siemens RUGGEDCOM RS8000
  • Siemens RUGGEDCOM RS8000A
  • Siemens RUGGEDCOM RS8000H
  • Siemens RUGGEDCOM RS8000T
  • Siemens RUGGEDCOM RS900
  • Siemens RUGGEDCOM RS900 (32M) V4.X
  • Siemens RUGGEDCOM RS900 (32M) V5.X
  • Siemens RUGGEDCOM RS900F
  • Siemens RUGGEDCOM RS900G
  • Siemens RUGGEDCOM RS900G (32M) V4.X
  • Siemens RUGGEDCOM RS900G (32M) V5.X
  • Siemens RUGGEDCOM RS900GF
  • Siemens RUGGEDCOM RS900GP
  • Siemens RUGGEDCOM RS900GPF
  • Siemens RUGGEDCOM RS900L
  • Siemens RUGGEDCOM RS900M-GETS-C01
  • Siemens RUGGEDCOM RS900M-GETS-XX
  • Siemens RUGGEDCOM RS900M-STND-C01
  • Siemens RUGGEDCOM RS900M-STND-XX
  • Siemens RUGGEDCOM RS900W
  • Siemens RUGGEDCOM RS910
  • Siemens RUGGEDCOM RS910L

Classification

Weakness
  • CWE-208 Observable Timing Discrepancy
  • CWE-203 Observable Discrepancy

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.