CVE-2020-12357

mediumPriorität · verfolgen · 27OT-Risiko · erhöhtEPSS 0.003 · 28. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.35% (28th) EPSS

CVSS 4.6 · medium

Is it mine?

105 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · siemens_psirt

EPSS · bewertet 2026-10-27

Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC Field PG M6siemens_psirt
Update BIOS to V26.01.08 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC3000 SMART V3siemens_psirt
Update BIOS to V01.04.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC347Gsiemens_psirt
Update BIOS to V01.04.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC427Esiemens_psirt
Update BIOS to V21.01.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC477Esiemens_psirt
Update BIOS to V21.01.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC477E Prosiemens_psirt
Update BIOS to V21.01.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC627Esiemens_psirt
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC647Esiemens_psirt
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC677Esiemens_psirt
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC847Esiemens_psirt
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC ITP1000siemens_psirt
Update BIOS to V23.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSINUMERIK 828D HW PU.4siemens_psirt
Update BIOS to V08.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK MC MCU 1720siemens_psirt
Update BIOS to V05.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10siemens_psirt
Update BIOS to V08.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK ONE NCU 1740siemens_psirt
Update BIOS to V05.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK ONE PPU 1740siemens_psirt
Update BIOS to V06.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSIMATIC Field PG M6cisa_csaf_ot
Update BIOS to V26.01.08 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC3000 SMART V3cisa_csaf_ot
Update BIOS to V01.04.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC347Gcisa_csaf_ot
Update BIOS to V01.04.00 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC427Ecisa_csaf_ot
Update BIOS to V21.01.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC477Ecisa_csaf_ot
Update BIOS to V21.01.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC477E Procisa_csaf_ot
Update BIOS to V21.01.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC627Ecisa_csaf_ot
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC647Ecisa_csaf_ot
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC677Ecisa_csaf_ot
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC IPC847Ecisa_csaf_ot
Update BIOS to V25.02.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSIMATIC ITP1000cisa_csaf_ot
Update BIOS to V23.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408
BehobenSINUMERIK 828D HW PU.4cisa_csaf_ot
Update BIOS to V08.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK MC MCU 1720cisa_csaf_ot
Update BIOS to V05.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10cisa_csaf_ot
Update BIOS to V08.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK ONE NCU 1740cisa_csaf_ot
Update BIOS to V05.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
BehobenSINUMERIK ONE PPU 1740cisa_csaf_ot
Update BIOS to V06.00.00.00 or later version SINUMERIK software can be obtained from your local Siemens account manager.
MitigationSIMATIC Field PG M6siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC3000 SMART V3siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC347Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC477Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC477E Prosiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC547Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC627Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC647Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC677Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC847Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC ITP1000siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP family (incl. SIPLUS variant)siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK 828D HW PU.4siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK MC MCU 1720siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK ONE NCU 1740siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK ONE PPU 1740siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC Field PG M6cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC3000 SMART V3cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC347Gcisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC427Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC477Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC477E Procisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC547Gcisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC627Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC647Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC677Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC IPC847Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC ITP1000cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP family (incl. SIPLUS variant)cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK 828D HW PU.4cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK MC MCU 1720cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK ONE / SINUMERIK 840D sl Handheld Terminal HT 10cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK ONE NCU 1740cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
MitigationSINUMERIK ONE PPU 1740cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
Kein Fix geplantSIMATIC IPC547Gsiemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC S7-1500 CPU 1518-4 PN/DP MFP family (incl. SIPLUS variant)siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC IPC547Gcisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC S7-1500 CPU 1518-4 PN/DP MFP family (incl. SIPLUS variant)cisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot
Currently no fix is planned

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.5

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 6.4

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 0.8 · Auswirkung 5.9

v3.17.5highCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:Csecondary · CISA US

v3.17.5highCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:Csecondary · Siemens ProductCERT DE

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-665USprimärCWE-311USCWE-311US

betroffene Produkte (105)

Betroffene Produkte und Versionsbereiche.

Avaya Aura Application Enablement Servicesalle Versionencert_bundDEcpe:/a:avaya:aura_application_enablement_services:-
Avaya Aura Communication Manageralle Versionencert_bundDEcpe:/a:avaya:communication_manager:-
Avaya Aura Device Servicesalle Versionencert_bundDEcpe:/a:avaya:aura_device_services:-
Avaya Aura Experience Portalalle Versionencert_bundDEcpe:/a:avaya:aura_experience_portal:-
Avaya Aura Session Manageralle Versionencert_bundDEcpe:/a:avaya:session_manager:-
Avaya Aura System Manageralle Versionencert_bundDEcpe:/a:avaya:aura_system_manager:-
Avaya Breeze Platformalle Versionencert_bundDEcpe:/a:avaya:breeze_platform:-
Avaya CMSalle Versionencert_bundDEcpe:/a:avaya:call_management_system_server:-
Avaya Session Border Controlleralle Versionencert_bundDEcpe:/h:avaya:session_border_controller:-
Avaya Web License Manageralle Versionencert_bundDEcpe:/a:avaya:web_license_manager:-
Avaya one-Xalle Versionencert_bundDEcpe:/a:avaya:one-x:-
Citrix Systems Hypervisoralle Versionencert_bundDEcpe:/o:citrix:hypervisor:-
Citrix Systems XenServeralle Versionencert_bundDEcpe:/a:citrix:xenserver:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Dell Computeralle Versionencert_bundDEcpe:/o:dell:dell_computer:-
EMC Avamaralle Versionencert_bundDEcpe:/a:emc:avamar:-
F5 BIG-IPalle Versionencert_bundDEcpe:/a:f5:big-ip:-
Gentoo Linuxalle Versionencert_bundDEcpe:/o:gentoo:linux:-
HPE ProLiantalle Versionencert_bundDEcpe:/h:hp:proliant:-
Intel Prozessoralle Versionencert_bundDEcpe:/h:intel:intel_prozessor:-

20 von 105 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-309571SSA-309571: IPU 2021.1 Vulnerabilities in Siemens Industrial Products using Intel CPUs (June 2021)2021-08-10csaf · siemens_psirtDE
Intel has published information on vulnerabilities in Intel products in June 2021. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update. In this advisory we summarize: - "2021.1 IPU – Intel® CSME, SPS and LMS Advisory" Intel-SA-00459, - "2021.1 IPU – BIOS Advisory" Intel-SA-00463, - "2021.1 IPU – Intel® Processor Advisory" Intel-SA-00464, and - "2021.1 IPU - Intel Atom® Processor Advisory" Intel-SA-00465. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
WID-SEC-W-2024-1463Intel Prozessoren: Mehrere SchwachstellenDeutsch2021-06-08csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Intel Prozessoren ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
ICSA-21-222-05Siemens Industrial Products Intel CPUs (Update F)2021-08-10icsa · cisa_csaf_otUS
Intel has published information on vulnerabilities in Intel products in June 2021. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update. In this advisory we summarize: - "2021.1 IPU – Intel® CSME, SPS and LMS Advisory" Intel-SA-00459, - "2021.1 IPU – BIOS Advisory" Intel-SA-00463, - "2021.1 IPU – Intel® Processor Advisory" Intel-SA-00464, and - "2021.1 IPU - Intel Atom® Processor Advisory" Intel-SA-00465. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund siemens_psirt cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2021-06-09geändert 2026-06-17

verwandt (659)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-50302US	medium5.5OT kritisch	0.81% (57th)	KEV	2024-11-19
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in variou…
CVE-2023-49105US	critical9.8OT kritisch	43.2% (99th)	KEV	2023-11-21
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, an…
CVE-2022-0847US	high7.8OT kritisch	92.8% (100th)	KEV	2022-03-10
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker…
CVE-2020-27950US	medium5.5OT kritisch	16.5% (97th)	KEV	2020-12-08
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Upd…
CVE-2013-1675US	medium6.5OT kritisch	6.70% (94th)	KEV	2013-05-16
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the ns…

+654 weitere

Referenzen (16)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan