CVE-2020-9273
highPriorität · beachten · 49EPSS 0.121 · 96. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-27
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC CP 1543-1 (incl. SIPLUS variants)siemens_psirt
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800773/ - BehobenSIMATIC CP 1545-1siemens_psirt
Update to V1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811116/ - BehobenSIMATIC CP 1543-1 (incl. SIPLUS variants)cisa_csaf_ot
Update to V3.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800773/ - BehobenSIMATIC CP 1545-1cisa_csaf_ot
Update to V1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811116/ - MitigationSIMATIC CP 1543-1 (incl. SIPLUS variants)siemens_psirt
Disable the embedded FTP server. The server is deactivated in the default configuration
- MitigationSIMATIC CP 1545-1siemens_psirt
Disable the embedded FTP server. The server is deactivated in the default configuration
- MitigationSIMATIC CP 1543-1 (incl. SIPLUS variants)cisa_csaf_ot
Disable the embedded FTP server. The server is deactivated in the default configuration
- MitigationSIMATIC CP 1545-1cisa_csaf_ot
Disable the embedded FTP server. The server is deactivated in the default configuration
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (1)
Öffentlicher Proof-of-Concept- und Exploit-Code.
betroffene Produkte (28)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-679335SSA-679335: Multiple Vulnerabilities in Embedded FTP Server of SIMATIC CP Modules2021-08-10csaf · siemens_psirtDE
SIMATIC CP 1543-1 and CP 1545-1 devices are affected by multiple vulnerabilities in ProFTPD, a third party component, that could allow a remote attacker to access sensitive information and execute arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-21-222-07Siemens SIMATIC CP (Update A)2021-08-10icsa · cisa_csaf_otUS
SIMATIC CP 1543-1 and CP 1545-1 devices are affected by multiple vulnerabilities in ProFTPD, a third party component, that could allow a remote attacker to access sensitive information and execute arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (45)
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.htmlcnnvd
- http://www.nsfocus.net/vulndb/45952cnnvd
- http://www.openwall.com/lists/oss-security/2021/08/25/1cnnvd
- http://www.openwall.com/lists/oss-security/2021/09/06/2cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdfcnnvd
- https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTEScnnvd
- https://github.com/proftpd/proftpd/issues/903cnnvd
- https://lists.debian.org/debian-lts-announce/2020/02/msg00022.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan