Vulnerability · Published Apr 22, 2021 · Assigned by siemens
CVE-2020-25244
High 8.4
In plain English
A high-severity uncontrolled search path in LOGO! Soft Comfort from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). The software insecurely loads libraries which makes it vulnerable to DLL hijacking. Successful exploitation by a local attacker could lead to a takeover of the system where the software is installed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | LOGO! Soft Comfort | All versions < V8.4 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-983300.pdf x_refsource_MISC