SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family
Devices of the LOGO! CMR family and the SIMATIC RTU 3000 family are affected by several vulnerabilities in the third party component Mbed TLS. They could allow an attacker with access to any of the interfaces of an affected device to impact the availability or to communicate with invalid certificates. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-36478US | high7.5 | — | ||
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) a… | ||||
| CVE-2020-36475US | high7.5 | — | ||
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family - CSAF Versionself
- SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family - PDF Versionself
- SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family - TXT Versionself
Behebungen (24)
- MitigationLOGO! CMR2020
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2020
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2040
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationLOGO! CMR2040
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3010C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3010C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3030C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3030C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3031C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3031C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3041C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- MitigationSIMATIC RTU3041C
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
- BehobenLOGO! CMR2020
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - BehobenLOGO! CMR2020
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - BehobenLOGO! CMR2040
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - BehobenLOGO! CMR2040
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800267/ - BehobenSIMATIC RTU3010C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3010C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3030C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3030C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3031C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3031C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3041C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - BehobenSIMATIC RTU3041C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan