SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family
Devices of the LOGO! CMR family and the SIMATIC RTU 3000 family are affected by several vulnerabilities in the third party component Mbed TLS. They could allow an attacker with access to any of the interfaces of an affected device to impact the availability or to communicate with invalid certificates. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-36478US | high7.5 | — | ||
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) a… | ||||
| CVE-2020-36475US | high7.5 | — | ||
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying… | ||||
references
External citations — patches, advisories, analysis.
- SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family - CSAF Versionself
- SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family - PDF Versionself
- SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family - TXT Versionself
remediations (24)
- MitigationLOGO! CMR2020
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2020
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2040
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2040
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3010C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3010C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3030C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3030C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3031C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3031C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3041C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3041C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- FixedLOGO! CMR2020
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - FixedLOGO! CMR2020
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - FixedLOGO! CMR2040
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - FixedLOGO! CMR2040
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - FixedSIMATIC RTU3010C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3010C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3030C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3030C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3031C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3031C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3041C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3041C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan