Siemens’ LOGO! programmable logic controllers (PLCs) are affected by critical vulnerabilities that can be exploited remotely to launch denial-of-service (DoS) attacks and modify the device’s configuration.
According to Siemens, the vulnerabilities impact all versions of its LOGO!8 BM devices, which are designed for basic control tasks. SIPLUS versions, which are meant for use in extreme conditions, are also affected.
The German industrial giant has yet to release patches for the vulnerabilities, which have been described as missing authentication issues, but it has told customers that they can reduce the risk of exploitation by applying defense-in-depth measures.
Siemens says an unauthenticated attacker who has network access to TCP port 135 can exploit the vulnerabilities to read and modify a device’s configuration and obtain project files, without user interaction.
While the advisories published this week by Siemens and CISA mention a single vulnerability, Cisco’s Talos threat intelligence and research group, which the vendor has credited for the findings, says there are actually three missing authentication flaws tracked under the same CVE identifier, CVE-2020-7589.
Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits Virtual Event Series
According to advisories published by Talos, all three vulnerabilities are related to the TDE text display functionality of LOGO! products, and they can all be exploited by sending specially crafted packets to the targeted system. Talos has released technical information on what these payloads look like.
The company says two of the flaws allow an attacker to delete information on the device, causing a denial-of-service (DoS) condition. The third bug can be exploited to upload or overwrite files on the SD card, which, Talos says, can impact the device’s integrity and availability.
Related: Siemens Industrial Devices Affected by ‘SegmentSmack’ Linux Kernel Flaw
Related: Siemens Addresses Vulnerabilities in LOGO, SINAMICS Products
Related: Siemens Patches Serious DoS Vulnerabilities in Several Products
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Intel Co-founder, Philanthropist Gordon Moore Dies at 94
- Google Leads $16 Million Investment in Dope.security
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
