CVE-2022-36360

highPriorität · verfolgen · 30OT-Risiko · erhöhtEPSS 0.003 · 23. PerzentilDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (23rd) EPSS

CVSS 7.5 · high

Is it mine?

6 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-28

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptographic method. This could allow an attacker to manipulate a firmware update and flash it to the device.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenLOGO! 8 BM (incl. SIPLUS variants)siemens_psirt
Update to V8.3 or later version. Note that in order to update, a new hardware version is required
https://support.industry.siemens.com/cs/ww/en/view/109783346/
BehobenLOGO! 8 BM (incl. SIPLUS variants)cisa_csaf_ot
Update to V8.3 or later version. Note that in order to update, a new hardware version is required
https://support.industry.siemens.com/cs/ww/en/view/109783346/
MitigationLOGO! 8 BM (incl. SIPLUS variants)siemens_psirt
Be especially careful to obtain and install firmware upgrades only from official sources
MitigationLOGO! 8 BM (incl. SIPLUS variants)cisa_csaf_ot
Be especially careful to obtain and install firmware upgrades only from official sources

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.1–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.16.1mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.16.1mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-345USprimärCWE-354USprimärCWE-345USCWE-345US

betroffene Produkte (6)

Betroffene Produkte und Versionsbereiche.

LOGO! 8 BM (incl. SIPLUS variants)alle Versionencisa_csaf_otUS
Siemens LOGO! 8 BM (incl. SIPLUS variants)< V8.3cisa_csaf_otUS
Siemens LOGO! 8 BM (incl. SIPLUS variants)All versions → V8.3enisa_euvdEU
siemens logo! 8 bm firmware< 8.3nvdUScpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:*
siemens logo!8 bm fs-05 firmware< 8.3nvdUScpe:2.3:o:siemens:logo\!8_bm_fs-05_firmware:*:*:*:*:*:*:*:*
Siemens LOGO! 8 BM (incl. SIPLUS variants)< V8.3siemens_psirtDE

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-928782SSA-928782: Firmware Authenticity Vulnerability in LOGO! 8 BM Devices2022-10-11csaf · siemens_psirtDE
LOGO! 8 BM (incl. SIPLUS variants) contains a vulnerability that could allow an attacker to install manipulated firmware packages. Siemens has released an update for the LOGO! 8 BM (incl. SIPLUS variants) and recommends to update to the latest version.
ICSA-22-286-01Siemens LOGO!2022-10-11icsa · cisa_csaf_otUS
LOGO! 8 BM (incl. SIPLUS variants) contains a vulnerability that could allow an attacker to install manipulated firmware packages. Siemens has released an update for the LOGO! 8 BM (incl. SIPLUS variants) and recommends to update to the latest version.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2022-10-11geändert 2026-06-17

verwandt (1,850)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-38831US	high7.8OT kritisch	99.8% (100th)	KEV	2023-08-23
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may inc…
CVE-2022-40139US	high7.2OT kritisch	3.44% (89th)	KEV	2022-09-19
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administra…
CVE-2022-26871US	critical9.8OT kritisch	19.5% (97th)	KEV	2022-03-29
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execut…
CVE-2019-5591US	medium6.5OT kritisch	18.6% (97th)	KEV	2020-08-14
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
CVE-2023-48795US	medium5.9OT hoch	93.5% (100th)	Exploit	2023-12-18
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet…

+1845 weitere

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan