Siemens LOGO! 12/24RCE

CVE-2022-42784

HIGH 7.6

At a glance

Source: NVD
EPSS: EPSS 0.25 % · percentile 16 (2026-10-31)
State: PUBLISHED
Published: 2023-12-12 10:02 UTC
Updated: 2024-10-08 08:39 UTC
Assigner: siemens
NVD status: Modified

Search on…

Description

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions >= V8.3), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions >= V8.3), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions >= V8.3), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions >= V8.3), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions >= V8.3), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions >= V8.3), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions >= V8.3). Affected devices are vulnerable to an electromagnetic fault injection. This could allow an attacker to dump and debug the firmware, including the manipulation of memory. Further actions could allow to inject public keys of custom created key pairs which are then signed by the product CA. The generation of a custom certificate allows communication with, and impersonation of, any device of the same version.

Weaknesses (CWE)

CWE-1319 — Improper Protection against Electromagnetic Fault Injection (EM-FI)

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens
CVSS 3.1	HIGH 7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2022-45847
GCVE · GCVE-0-2022-42784

CERT-FR advisories

CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:siemens:6ed1052-1md08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2md08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-1cc08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2cc08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-1hb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2hb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-1fb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2fb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1md08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2md08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1cc08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2cc08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1hb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2hb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1fb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2fb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3

Affected products

Product	Versions
Siemens · LOGO! 12/24RCE	affected V8.3 < *
Siemens · LOGO! 12/24RCEo	affected V8.3 < *
Siemens · LOGO! 230RCE	affected V8.3 < *
Siemens · LOGO! 230RCEo	affected V8.3 < *
Siemens · LOGO! 24CE	affected V8.3 < *
Siemens · LOGO! 24CEo	affected V8.3 < *
Siemens · LOGO! 24RCE	affected V8.3 < *
Siemens · LOGO! 24RCEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 12/24RCE	affected V8.3 < *
Siemens · SIPLUS LOGO! 12/24RCEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 230RCE	affected V8.3 < *
Siemens · SIPLUS LOGO! 230RCEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 24CE	affected V8.3 < *
Siemens · SIPLUS LOGO! 24CEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 24RCE	affected V8.3 < *
Siemens · SIPLUS LOGO! 24RCEo	affected V8.3 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens LOGO! 12/24RCE