Electromagnetic Fault Injection Vulnerability in Siemens LOGO! Products

CVE-2022-42784

Summary

A vulnerability has been identified in Siemens LOGO! devices, allowing attackers to exploit electromagnetic fault injection. This allows them to dump and debug firmware, manipulate memory, and inject public keys for custom key pairs that can be signed by the product's certificate authority. Consequently, attackers can create custom certificates, facilitating unauthorized communication with and impersonation of other devices running the same version.

References