A flaw in Siemens RUGGEDCOM RST2428P causes sensitive configuration data to be stored in the browser cache after an authenticated user modifies certain settings. The vulnerability, classified with CWE-525, can lead to unauthorized access to confidential information if an attacker gains access to the browser environment. The attack requires user authentication, and the attacker must visit the device’s web interface while the data remains cached.

All models of the RUGGEDCOM RST2428P, version 6GK6242-6PA00 and earlier than V4.0, are affected.

The vulnerability carries a CVSS score of 5.9, indicating a moderate risk level. No EPSS value is available, and the issue is not listed in the CISA KEV catalogue. Exploitation requires legitimate credentials and a user to access the web interface after a configuration change, making it an authenticated but non-remote attack. The potential impact includes the inadvertent exposure of confidential data to anyone who can control or read the local browser cache.