PT-2019-2287 · Siemens · Logo! 8 Bm

Manuel Stotz + 1 · Published 2019-05-14 · Updated 2022-01-04 · CVE-2019-10920

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM (incl. SIPLUS variants) versions prior to V8.3

Description A security issue has been identified where project data stored on the device can be decrypted due to a hardcoded encryption key. This data is accessible via port 10005/tcp. An unauthenticated attacker with network access to this port can exploit the issue without requiring any user interaction, impacting the confidentiality of the device. At the time of reporting, there were no known public exploits of this issue.

Recommendations For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

BDU:2019-02058

CVE-2019-10920

Affected Products

Logo! 8 Bm

References · 8

• https://bdu.fstec.ru/vul/2019-02058 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10920 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10920 · Vendor Advisory
• http://packetstormsecurity.com/files/153122/Siemens-LOGO-8-Hard-Coded-Cryptographic-Key.html · Note
• http://seclists.org/fulldisclosure/2019/May/44 · Note
• https://seclists.org/bugtraq/2019/May/72 · Note
• http://securityfocus.com/bid/108382 · Note