Skip to content
OpenAdvisories
Critical SSA-824231 1 CVE

SSA-824231: Unauthenticated Firmware Upload Vulnerability in Desigo PX Controllers

Published Jan 24, 2018 · Updated Jun 13, 2023 · Revision 5

Vendor: Siemens Product: Desigo PXC00-E.D V4.10 Product: Desigo PXC00-E.D V5.00 Product: Desigo PXC00-E.D V5.10 Product: Desigo PXC00-E.D V6.00 Product: Desigo PXC00/64/128-U V4.10 Product: Desigo PXC00/64/128-U V5.00 Product: Desigo PXC00/64/128-U V5.10 Product: Desigo PXC00/64/128-U V6.00 Product: Desigo PXC001-E.D V4.10 Product: Desigo PXC001-E.D V5.00 Product: Desigo PXC001-E.D V5.10 Product: Desigo PXC001-E.D V6.00 Product: Desigo PXC100-E.D V4.10 Product: Desigo PXC100-E.D V5.00 Product: Desigo PXC100-E.D V5.10 Product: Desigo PXC100-E.D V6.00 Product: Desigo PXC12-E.D V4.10 Product: Desigo PXC12-E.D V5.00 Product: Desigo PXC12-E.D V5.10 Product: Desigo PXC12-E.D V6.00 Product: Desigo PXC200-E.D V4.10 Product: Desigo PXC200-E.D V5.00 Product: Desigo PXC200-E.D V5.10 Product: Desigo PXC200-E.D V6.00 Product: Desigo PXC22-E.D V4.10 Product: Desigo PXC22-E.D V5.00 Product: Desigo PXC22-E.D V5.10 Product: Desigo PXC22-E.D V6.00 Product: Desigo PXC22.1-E.D V4.10 +15 more

Summary

Several Desigo PXC/PXM devices contain a vulnerability that could allow unauthenticated remote attackers to upload malicious firmware without prior authentication.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

Revision history

  1. #5

    Listed the affected product version lines and associated fix versions explicitly; no significant change of contents compared to previous advisory release (2019-03-12)

  2. #4

    Older firmware versions added

  3. #3

    Clarified that Apogee PX product line is out of scope

  4. #2

    Removed broken links

  5. #1

    Publication Date

References