CVE-2019-10920: siemens logo! 8 bm (incl. siplus variants) Use of Hard-coded Cryptographic Key

Vulnerability summary

CVE-2019-10920 is a high (CVSS 7.5) Use of Hard-coded Cryptographic Key vulnerability in siemens logo! 8 bm (incl. siplus variants). EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 74.1% of scored vulnerabilities.

Timeline

1. 14-05-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.
• CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.