PT-2019-2288 · Siemens · Logo! 8 Bm

Manuel Stotz + 1 · Publicado 2019-05-14 · Atualizado 2022-01-04 · CVE-2019-10921

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM versions prior to V8.3

Description The issue is related to the storage of unencrypted passwords in the project data. An attacker with network access to port 10005/tcp could exploit this to obtain device passwords. No user interaction is required for exploitation, and it affects the confidentiality of the device. At the time of reporting, there were no known public exploits.

Recommendations For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

CWE-255

CWE-256

Identificadores relacionados

BDU:2019-02059

CVE-2019-10921

Produtos afetados

Logo! 8 Bm

Referências · 8

• 🔥 https://seclists.org/bugtraq/2019/May/74 · Exploit
• 🔥 http://packetstormsecurity.com/files/153124/Siemens-LOGO-8-Recoverable-Password-Format.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/May/49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10921 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10921 · Aviso do Fabricante
• http://securityfocus.com/bid/108382 · Nota
• https://bdu.fstec.ru/vul/2019-02059 · Nota de Segurança