Vulnerability · Published Jul 14, 2020 · Assigned by siemens

CVE-2020-7593

Critical 9.8

In plain English

A critical-severity buffer overflow in LOGO! 8 BM (incl. SIPLUS variants) from Siemens AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.7% (higher than 95% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)8.7%top 4.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.02). A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacker could send a specially crafted HTTP request to cause a memory corruption, potentially resulting in remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Siemens AG	LOGO! 8 BM (incl. SIPLUS variants)	V1.81.01 - V1.81.03
Siemens AG	LOGO! 8 BM (incl. SIPLUS variants)	V1.82.01
Siemens AG	LOGO! 8 BM (incl. SIPLUS variants)	V1.82.02

Weakness: CWE-120

References

https://cert-portal.siemens.com/productcert/pdf/ssa-573753.pdf x_refsource_MISC
https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1069 x_refsource_MISC