Session ID Exposure in LOGO! 8 BM by Siemens
CVE-2017-12734

7.5HIGH

Key Information:

Vendor
Siemens
Status
Logo! 8 Bm (incl. Siplus Variants)
Vendor
CVE Published:
30 August 2017

Summary

A vulnerability has been found in Siemens LOGO! 8 BM and its SIPLUS variants, affecting all versions prior to V1.81.2. Attackers with network access to the web server on port 80/tcp can potentially retrieve the session ID of a user currently logged into the web interface. It is critical that users limit the access to the integrated web server to trusted networks only to mitigate this risk.

Affected Version(s)

LOGO! 8 BM (incl. SIPLUS variants) All versions < V1.81.2

References

http://www.securityfocus.com/bid/100560
vdb-entryx_refsource_BID
https://cert-portal.siemens.com/productcert/pdf/ssa-08724...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.