CVE-2014-2250

{"id": "CVE-2014-2250", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-24T14:20:39.557", "references": [{"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf", "source": "cve@mitre.org"}, {"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251."}, {"lang": "es", "value": "El generador de n\u00fameros aleatorios en dispositivos de Siemens SIMATIC S7-1200 CPU PLC con firmware anterior a 4.0 no tiene suficiente entrop\u00eda, lo que facilita a atacantes remotos anular mecanismos de protecci\u00f3n criptogr\u00e1fica y secuestrar sesiones a trav\u00e9s de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2251."}], "lastModified": "2024-11-21T02:05:55.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BCF4722-1850-48CD-9BCA-6EBD9EFF8147", "versionEndIncluding": "3.0.2"}, {"criteria": "cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8C7A9D3-33C0-465B-914D-3D1FF1BE8272"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu-1211c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7F8E0D6-D9DE-4F2A-A0D3-84A9EEB8EAFD"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1212c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6A11F4A-4DA2-4EDC-A51F-69DA422C320F"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1214c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EB6306C-2F6E-49A3-BFAE-BA6962501697"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1215c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DC6AAEF-22EE-449B-83A8-9BE0B84199EE"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1217c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36F69756-6304-489F-A287-65D0A9E81943"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}