PT-2020-16028 · Siemens · Logo! 8 Bm+1

Published 2020-12-14 · Updated 2020-12-16 · CVE-2020-25231

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM (incl. SIPLUS variants) versions prior to V8.3 LOGO! Soft Comfort versions prior to V8.3

Description A vulnerability has been identified where the encryption of program data for the affected devices uses a static key. An attacker could use this key to extract confidential information from protected program files.

Recommendations For LOGO! 8 BM (incl. SIPLUS variants) versions prior to V8.3, update to version V8.3 or later to resolve the issue. For LOGO! Soft Comfort versions prior to V8.3, update to version V8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to protected program files until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2020-25231

Affected Products

Logo! 8 Bm

Logo! Soft Comfort

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25231 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25231 · Vendor Advisory
• https://t.me/cibsecurity/20794 · Telegram Post