Siemens LOGO! 12/24RCE

CVE-2022-36361

CRITICAL 9.8

En bref

Source: NVD
EPSS: EPSS 1.09 % · centile 66 (2026-10-31)
État: PUBLISHED
Publiée: 2022-10-11 00:00 UTC
Mise à jour: 2024-11-20 14:54 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). Affected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code.

Faiblesses (CWE)

CWE-120 — Copie de tampon sans vérification de taille (débordement classique)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C	siemens
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Secondary)

Références européennes

ENISA EUVD · EUVD-2022-39076
GCVE · GCVE-0-2022-36361

Avis du CERT-FR

CERTFR-2022-AVI-897 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:logo\!8_bm_fs-05_firmware:*:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Siemens · LOGO! 12/24RCE	affected 0 < *
Siemens · LOGO! 12/24RCEo	affected 0 < *
Siemens · LOGO! 230RCE	affected 0 < *
Siemens · LOGO! 230RCEo	affected 0 < *
Siemens · LOGO! 24CE	affected 0 < *
Siemens · LOGO! 24CEo	affected 0 < *
Siemens · LOGO! 24RCE	affected 0 < *
Siemens · LOGO! 24RCEo	affected 0 < *
Siemens · SIPLUS LOGO! 12/24RCE	affected 0 < *
Siemens · SIPLUS LOGO! 12/24RCEo	affected 0 < *
Siemens · SIPLUS LOGO! 230RCE	affected 0 < *
Siemens · SIPLUS LOGO! 230RCEo	affected 0 < *
Siemens · SIPLUS LOGO! 24CE	affected 0 < *
Siemens · SIPLUS LOGO! 24CEo	affected 0 < *
Siemens · SIPLUS LOGO! 24RCE	affected 0 < *
Siemens · SIPLUS LOGO! 24RCEo	affected 0 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Siemens LOGO! 12/24RCE