Skip to content
OpenAdvisories
Medium SSA-921449 1 CVE

SSA-921449: Plaintext Storage of a Password Vulnerability in LOGO! V8.3 BM Devices

Published Aug 13, 2024 · Updated Oct 8, 2024 · Revision 3

Vendor: Siemens Product: LOGO! 12/24RCE (6ED1052-1MD08-0BA1) Product: LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) Product: LOGO! 230RCE (6ED1052-1FB08-0BA1) Product: LOGO! 230RCEo (6ED1052-2FB08-0BA1) Product: LOGO! 24CE (6ED1052-1CC08-0BA1) Product: LOGO! 24CEo (6ED1052-2CC08-0BA1) Product: LOGO! 24RCE (6ED1052-1HB08-0BA1) Product: LOGO! 24RCEo (6ED1052-2HB08-0BA1) Product: SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) Product: SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) Product: SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) Product: SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) Product: SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) Product: SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) Product: SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) Product: SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1)

Summary

LOGO! V8.3 BM (incl. SIPLUS variants) devices contain a plaintext storage of a password vulnerability. This could allow an attacker with phyiscal access to an affected device to extract user-set passwords from an embedded storage IC.

Siemens has released new hardware versions with the LOGO! V8.4 BM and the SIPLUS LOGO! V8.4 BM product families for all affected devices in which the vulnerability is fixed. See the chapter "Additional Information" below for more details.

Vulnerabilities 1

Revision history

  1. #3

    Added information about additional new SIPLUS LOGO! hardware versions

  2. #2

    Added researcher acknowledgment and information about additional new SIPLUS LOGO! hardware versions: SIPLUS LOGO! 24CE and SIPLUS LOGO! 230RCE

  3. #1

    Publication Date

References