CVE-2022-36360: Siemens LOGO! 8 BM (incl. SIPLUS variants), логическа

Описание

Оригинално описание

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the authenticity. Furthermore the integrity of the unencrypted firmware is only verified by a non-cryptographic method. This could allow an attacker to manipulate a firmware update and flash it to the device.

Засегнати продукти

• Siemens LOGO! 8 BM (incl. SIPLUS variants): All versions < V8.3

Вид слабост

• CWE-345 Недостатъчна проверка на автентичността на данните

История

Други уязвимости в Siemens LOGO! 8 BM (incl. SIPLUS variants)

• CVE-2020-25233
• CVE-2020-25234
• CVE-2020-25235
• CVE-2020-25232
• CVE-2020-25228

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-36360
• https://nvd.nist.gov/vuln/detail/CVE-2022-36360
• https://cert-portal.siemens.com/productcert/pdf/ssa-928782.pdf