Session Management Flaw in SIEMENS LOGO!8 Products
CVE-2019-6584

8.8HIGH

Key Information:

Vendor
Siemens
Status
Siemens Logo!8
Vendor
CVE Published:
12 June 2019

Summary

A session management issue has been identified in SIEMENS LOGO!8 devices where the integrated web server fails to invalidate the Session ID upon user logout. This flaw allows an attacker with access to the network or who can read communication between the device and the user to exploit valid Session IDs, continuing access even after legitimate user logout. Given the severity of this oversight, it highlights the need for stringent session management practices to ensure user sessions are appropriately terminated.

Affected Version(s)

SIEMENS LOGO!8 6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx

SIEMENS LOGO!8 6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02

References

https://cert-portal.siemens.com/productcert/pdf/ssa-77485...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.