Vulnerability CVE-2019-10919


Published: 2019-05-14

Description:
A vulnerability has been identified in LOGO!8 BM (All versions). Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

Type:

CWE-284

(Improper Access Control)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Siemens -> Logo!8 bm firmware 

 References:
http://packetstormsecurity.com/files/153123/Siemens-LOGO-8-Missing-Authentication.html
http://seclists.org/fulldisclosure/2019/May/45
http://www.securityfocus.com/bid/108382
https://cert-portal.siemens.com/productcert/pdf/ssa-542701.pdf
https://seclists.org/bugtraq/2019/May/73

Copyright 2024, cxsecurity.com

 

Back to Top