PT-2014-4585 · Siemens · Simatic S7-1500 Cpu

Aleksandr Timorin + 4 · Published 2014-03-16 · Updated 2020-02-10 · CVE-2014-2251

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0

Description The issue concerns the random-number generator, which lacks sufficient entropy. This weakness can be exploited by remote attackers to bypass cryptographic protection mechanisms and hijack sessions.

Recommendations For versions prior to 1.5.0, update the firmware to version 1.5.0 or later to address the issue.

Fix

Related Identifiers

CVE-2014-2251

Affected Products

Simatic S7-1500 Cpu

References · 4

• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2251 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 · Note