CVE-2015-5537 — The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566

Back Back to CVE browser

MEDIUM

The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566

Published Aug 3, 2015

4.3

MEDIUM

CVSS 2.0

EPSS 1.14%

Description

The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.14% 0.01139

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01139

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.14% (0.01139)	65.40th	v5 (v2026.06.15)
Jun 15, 2026	1.14% (0.01139)	62.30th	v5 (v2026.06.15)
Mar 17, 2025	0.60% (0.00604)	67.73th	v4 (v2025.03.14)
Dec 12, 2024	0.09% (0.00094)	41.51th	v3 (v2023.03.01)
Jul 13, 2024	0.09% (0.00094)	40.27th	v3 (v2023.03.01)
Mar 7, 2023	0.09% (0.00094)	38.26th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)

Weaknesses (1)

CWE-312

References (3)

http://www.securitytracker.com/id/1033022
vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-396873.pdf
x_refsource_CONFIRMBroken LinkPatchVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03A
x_refsource_MISCBroken LinkThird Party AdvisoryUS Government Resource

Link	Providers	Tags
http://www.securitytracker.com/id/1033022		vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-396873.pdf		x_refsource_CONFIRMBroken LinkPatchVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03A		x_refsource_MISCBroken LinkThird Party AdvisoryUS Government Resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 3, 2015

Updated Aug 6, 2024

Reserved Jul 17, 2015

Link CVE-2015-5537

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2015-5537

Red Hat

Severity n/a

Public date n/a

Links CVE-2015-5537