A vulnerability classified as problematic was found in Siemens LOGO! up to 1.81.1. This vulnerability affects an unknown function of the component Integrated Web Server. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

A vulnerability has been identified in Siemens LOGO! devices before V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use the integrated webserver on port 80/tcp only in trusted networks.

The bug was discovered 08/31/2017. The weakness was shared 08/30/2017 by Maxim Rupp (Website). The advisory is available at siemens.com. This vulnerability was named CVE-2017-12734 since 08/09/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 1.81.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100560†). The entry VDB-105995 is related to this item.

Productinfo

Vendor

• Siemens

Name

• LOGO!

Version

• 1.81.0
• 1.81.1

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion