PT-2019-2288 · Siemens · Logo! 8 Bm

Manuel Stotz + 1 · Published 2019-05-14 · Updated 2022-01-04 · CVE-2019-10921

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM versions prior to V8.3

Description The issue is related to the storage of unencrypted passwords in the project data. An attacker with network access to port 10005/tcp could exploit this to obtain device passwords. No user interaction is required for exploitation, and it affects the confidentiality of the device. At the time of reporting, there were no known public exploits.

Recommendations For versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10005/tcp to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-255

CWE-256

Related Identifiers

BDU:2019-02059

CVE-2019-10921

Affected Products

Logo! 8 Bm

References · 8

• 🔥 https://seclists.org/bugtraq/2019/May/74 · Exploit
• 🔥 http://packetstormsecurity.com/files/153124/Siemens-LOGO-8-Recoverable-Password-Format.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/May/49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10921 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10921 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02059 · Security Note
• http://securityfocus.com/bid/108382 · Note