CVE-2014-2251

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.

CVSS v2.0 8.3 HIGH

8.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:C

Exploitability : 8.6 / Impact : 8.5

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01	US Government Resource
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf	Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01	US Government Resource
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf	Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware::::::::
	cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.0.1:::::::*
	cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.1.0:::::::*
	cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.1.1:::::::*

History

21 Nov 2024, 02:05

Type	Values Removed	Values Added
References	~~() http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 - US Government Resource~~	() http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 - US Government Resource
References	~~() http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf - Patch, Vendor Advisory~~	() http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf - Patch, Vendor Advisory
References	~~() https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf -~~	() https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf -

Information

Published : 2014-03-16 14:06

Updated : 2024-11-21 02:05

NVD link : CVE-2014-2251

Mitre link : CVE-2014-2251

CVE.ORG link : CVE-2014-2251

JSON object : View

Products Affected

siemens

simatic_s7-1500_cpu_firmware

CWE

NVD-CWE-Other

{"id": "CVE-2014-2251", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-16T14:06:45.867", "references": [{"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf", "source": "cve@mitre.org"}, {"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors."}, {"lang": "es", "value": "El generador de n\u00fameros aleatorios en dispositivos de Siemens SIMATIC S7-1500 CPU PLC con firmware anterior a 1.5.0 no tiene suficiente entrop\u00eda, lo que facilita a atacantes remotos derrotar mecanismos de protecci\u00f3n criptogr\u00e1ficos y secuestrar sesiones a trav\u00e9s de vectores no especificados."}], "lastModified": "2024-11-21T02:05:56.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F9DE401-8833-4BBC-A9F9-6275484C932C", "versionEndIncluding": "1.1.2"}, {"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00673095-ABE2-44E9-B032-3C0D9FD4DADC"}, {"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7034B3A-0E68-46CB-B481-A644CAF26855"}, {"criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABE40AA5-31F1-42E7-9C96-EB0812EA699D"}], "operator": "OR"}]}], "evaluatorComment": "CWE-331: Insufficient Entropy", "sourceIdentifier": "cve@mitre.org"}