PT-2019-2285 · Siemens · Logo! Soft Comfort

Published 2019-05-14 · Updated 2022-01-04 · CVE-2019-10924

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LOGO! Soft Comfort versions prior to V8.3

Description A vulnerability has been identified that could allow an attacker to execute arbitrary code if a legitimate user opens a manipulated project file. No further privileges are required on the target system. The issue is related to errors in access control. Exploitation could compromise the confidentiality, integrity, and availability of the engineering station. At the time of advisory publication, no public exploitation of this security issue was known.

Recommendations For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting the opening of project files from untrusted sources to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Improper Access Control

Weakness Enumeration

CWE-502

CWE-284

Related Identifiers

BDU:2019-02056

CVE-2019-10924

Affected Products

Logo! Soft Comfort

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10924 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-102144.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02056 · Security Note
• http://securityfocus.com/bid/108368 · Note