CVE-2022-42784
Description
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions >= V8.3), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions >= V8.3), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions >= V8.3), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions >= V8.3), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions >= V8.3), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions >= V8.3), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions >= V8.3), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions >= V8.3). Affected devices are vulnerable to an electromagnetic fault injection. This could allow an attacker to dump and debug the firmware, including the manipulation of memory. Further actions could allow to inject public keys of custom created key pairs which are then signed by the product CA. The generation of a custom certificate allows communication with, and impersonation of, any device of the same version.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens 6ed1052-1md08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-2md08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-1cc08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-2cc08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-1hb08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-2hb08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-1fb08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ed1052-2fb08-0ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-1md08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-2md08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-1cc08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-2cc08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-1hb08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-2hb08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-1fb08-7ba1_firmware | v ≤ 8.3 | — |
| siemens 6ag1052-2fb08-7ba1_firmware | v ≤ 8.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.