CVE-2020-25234

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions (UDF) in a password protected way. This protection is implemented in the software that displays the information. An attacker could reverse engineer the UDFs directly from stored program files.

CVSS v3 7.7 HIGH
CVSS v2.0 3.6 LOW

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 3.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:logo\!_8_bm:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:17

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf - Vendor Advisory~~	() https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf - Vendor Advisory

Information

Published : 2020-12-14 21:15

Updated : 2024-11-21 05:17

NVD link : CVE-2020-25234

Mitre link : CVE-2020-25234

CVE.ORG link : CVE-2020-25234

JSON object : View

Products Affected

siemens

logo\!_8_bm_firmware
logo\!_8_bm

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2020-25234", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.5}]}, "published": "2020-12-14T21:15:20.130", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions (UDF) in a password protected way. This protection is implemented in the software that displays the information. An attacker could reverse engineer the UDFs directly from stored program files."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en LOGO! 8 BM (incluyendo variantes SIPLUS) (todas las versiones anteriores a V8.3), LOGO! Soft Comfort (todas las versiones anteriores a V8.3). Los archivos de programa de LOGO! generados y utilizados por los componentes afectados ofrecen la posibilidad de guardar funciones definidas por el usuario (UDF) en una forma protegida por contrase\u00f1a. Esta protecci\u00f3n es implementada en el software que muestra la informaci\u00f3n. Un atacante podr\u00eda aplicar ingenier\u00eda inversa a las UDF directamente desde los archivos de programa almacenados"}], "lastModified": "2024-11-21T05:17:43.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:logo\\!_8_bm_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FA7BA89-3BF0-4C68-AC47-951B1F11F96D", "versionEndExcluding": "8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:logo\\!_8_bm:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "59947FF6-3711-47C1-B91E-87DBF31DAF57"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}