Vulnerability · Published Dec 14, 2020 · Assigned by siemens
CVE-2020-25228
Critical 9.8
In plain English
A critical-severity missing authentication in LOGO! 8 BM (incl. SIPLUS variants) from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.6%top 23.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). A service available on port 10005/tcp of the affected devices could allow complete access to all services without authorization. An attacker could gain full control over an affected device, if he has access to this service. The system manual recommends to protect access to this port.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | LOGO! 8 BM (incl. SIPLUS variants) | All versions < V8.3 |
Weakness: CWE-306
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf x_refsource_MISC