PT-2019-2287 · Siemens · Logo! 8 Bm

Manuel Stotz + 1 · Publicado 2019-05-14 · Atualizado 2022-01-04 · CVE-2019-10920

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM (incl. SIPLUS variants) versions prior to V8.3

Description A security issue has been identified where project data stored on the device can be decrypted due to a hardcoded encryption key. This data is accessible via port 10005/tcp. An unauthenticated attacker with network access to this port can exploit the issue without requiring any user interaction, impacting the confidentiality of the device. At the time of reporting, there were no known public exploits of this issue.

Recommendations For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-321

Identificadores relacionados

BDU:2019-02058

CVE-2019-10920

Produtos afetados

Logo! 8 Bm

Referências · 8

• https://bdu.fstec.ru/vul/2019-02058 · Nota de Segurança
• http://packetstormsecurity.com/files/153122/Siemens-LOGO-8-Hard-Coded-Cryptographic-Key.html · Nota
• http://seclists.org/fulldisclosure/2019/May/44 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10920 · Nota de Segurança
• https://seclists.org/bugtraq/2019/May/72 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10920 · Aviso do Fabricante
• http://securityfocus.com/bid/108382 · Nota