CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25228
https://notcve.org/view.php?id=CVE-2020-25228
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). A service available on port 10005/tcp of the affected devices could allow complete access to all services without authorization. An attacker could gain full control over an affected device, if he has access to this service. • https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25231
https://notcve.org/view.php?id=CVE-2020-25231
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of program data for the affected devices uses a static key. • https://cert-portal.siemens.com/productcert/pdf/ssa-480824.pdf • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2020-7593
https://notcve.org/view.php?id=CVE-2020-7593
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01), LOGO! • https://cert-portal.siemens.com/productcert/pdf/ssa-573753.pdf https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1069 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7589
https://notcve.org/view.php?id=CVE-2020-7589
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 135/tcp. • https://cert-portal.siemens.com/productcert/pdf/ssa-817401.pdf https://www.us-cert.gov/ics/advisories/icsa-20-161-03 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-6584
https://notcve.org/view.php?id=CVE-2019-6584
A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. • https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •