Siemens LOGO! 8 BM DoS Vulnerability Advisory (CVE-2020-25236)

Key Information Vulnerability Description Vulnerability ID: SSA-783481 Vulnerability Type: Denial-of-Service (DoS) Vulnerability Affected Product: LOGO! 8 BM CVSS v3.1 Base Score: 5.5 Affected Scope Affected Versions: LOGO! V8.3 BM, SIPLUS LOGO! V8.3 BM Remediation Status: No planned fix currently available; refer to workarounds and mitigation measures. Workarounds and Mitigation Measures Recommendation: Limit the possibility of executing untrusted code. Workarounds and Mitigation Measures: Follow general security recommendations. General Security Recommendations Recommendation: Protect network access mechanisms to the device. Configuration Recommendation: Configure the environment according to Siemens Industrial Security Operations Guidelines. More Information: Recommendations can be found in the product manual. Product Description Product: LOGO! 8 BM Description: Control logic (CL) can be manipulated, causing improper processing and device crash when executing CL. Vulnerability Details Vulnerability ID: CVE-2020-25236 Description: Control logic (CL) can be manipulated, causing improper processing and device crash when executing CL. CVSS v3.1 Base Score: 5.5 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:T/RC:C CWE: CWE-755: Improper Handling of Exceptional Conditions Acknowledgments Thanks to: Max Bäumler for coordinated disclosure. Additional Information New Hardware Versions: Hardware versions of LOGO! V8.4 BM and SIPLUS LOGO! V8.4 BM product series. Contact: For further inquiries regarding security vulnerabilities, contact Siemens ProductCERT. Historical Data Versions: V1.0 (2021-03-09), V1.1 (2023-12-12), V1.2 (2024-09-10) Update Details: Added information about new LOGO! V8.4 BM hardware versions. Terms and Usage Terms: Siemens Security Advisories are subject to Siemens’ license terms or applicable other agreements.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens LOGO! 8 BM DoS Vulnerability Advisory (CVE-2020-25236)