Siemens LOGO! 12/24RCE

CVE-2022-42784

HIGH 7.6

En bref

Source: NVD
EPSS: EPSS 0.25 % · centile 16 (2026-10-31)
État: PUBLISHED
Publiée: 2023-12-12 10:02 UTC
Mise à jour: 2024-10-08 08:39 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions >= V8.3), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions >= V8.3), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions >= V8.3), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions >= V8.3), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions >= V8.3), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions >= V8.3), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions >= V8.3). Affected devices are vulnerable to an electromagnetic fault injection. This could allow an attacker to dump and debug the firmware, including the manipulation of memory. Further actions could allow to inject public keys of custom created key pairs which are then signed by the product CA. The generation of a custom certificate allows communication with, and impersonation of, any device of the same version.

Faiblesses (CWE)

CWE-1319 — Improper Protection against Electromagnetic Fault Injection (EM-FI)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens
CVSS 3.1	HIGH 7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2022-45847
GCVE · GCVE-0-2022-42784

Avis du CERT-FR

CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:6ed1052-1md08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2md08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-1cc08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2cc08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-1hb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2hb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-1fb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ed1052-2fb08-0ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1md08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2md08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1cc08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2cc08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1hb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2hb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-1fb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3
cpe:2.3:o:siemens:6ag1052-2fb08-7ba1_firmware:*:*:*:*:*:*:*:* ≤ 8.3

Produits affectés

Produit	Versions
Siemens · LOGO! 12/24RCE	affected V8.3 < *
Siemens · LOGO! 12/24RCEo	affected V8.3 < *
Siemens · LOGO! 230RCE	affected V8.3 < *
Siemens · LOGO! 230RCEo	affected V8.3 < *
Siemens · LOGO! 24CE	affected V8.3 < *
Siemens · LOGO! 24CEo	affected V8.3 < *
Siemens · LOGO! 24RCE	affected V8.3 < *
Siemens · LOGO! 24RCEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 12/24RCE	affected V8.3 < *
Siemens · SIPLUS LOGO! 12/24RCEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 230RCE	affected V8.3 < *
Siemens · SIPLUS LOGO! 230RCEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 24CE	affected V8.3 < *
Siemens · SIPLUS LOGO! 24CEo	affected V8.3 < *
Siemens · SIPLUS LOGO! 24RCE	affected V8.3 < *
Siemens · SIPLUS LOGO! 24RCEo	affected V8.3 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens LOGO! 12/24RCE