SSA-921449

csafDEsiemens_psirt

SSA-921449: Plaintext Storage of a Password Vulnerability in LOGO! V8.3 BM Devices

Advisory ansehen veröffentlicht 2024-08-13

LOGO! V8.3 BM (incl. SIPLUS variants) devices contain a plaintext storage of a password vulnerability. This could allow an attacker with phyiscal access to an affected device to extract user-set passwords from an embedded storage IC. Siemens has released new hardware versions with the LOGO! V8.4 BM and the SIPLUS LOGO! V8.4 BM product families for all affected devices in which the vulnerability is fixed. See the chapter "Additional Information" below for more details.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2024-39922US——
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (A…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (32)

  • MitigationLOGO! 12/24RCE (6ED1052-1MD08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 12/24RCEo (6ED1052-2MD08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 230RCE (6ED1052-1FB08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 230RCEo (6ED1052-2FB08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 24CE (6ED1052-1CC08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 24CEo (6ED1052-2CC08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 24RCE (6ED1052-1HB08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationLOGO! 24RCEo (6ED1052-2HB08-0BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • MitigationSIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1)

    Ensure the physical security of the affected devices to prevent unauthorized access (also see the operational guidelines for Industrial Security, especially: "Plant security: Physical prevention of access to critical components")

  • Kein Fix geplantLOGO! 12/24RCE (6ED1052-1MD08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 12/24RCEo (6ED1052-2MD08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 230RCE (6ED1052-1FB08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 230RCEo (6ED1052-2FB08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 24CE (6ED1052-1CC08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 24CEo (6ED1052-2CC08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 24RCE (6ED1052-1HB08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantLOGO! 24RCEo (6ED1052-2HB08-0BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1)

    Currently no fix is planned

  • Kein Fix geplantSIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1)

    Currently no fix is planned

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan