SSA-774850 (Last Update: 2019-06-11): Vulnerabilities in SIEMENS LOGO!8 devices

2019-06-11 00:00:00 UTC

Two vulnerabilities have been identified in SIEMENS LOGO!8 devices. The Session ID on the integrated webserver of LOGO!8 devices is not invalidated upon logout. The second vulnerability could allow an attacker with network access to port 10005/tcp to cause a Denial-of-Service condition by sending specifically crafted packages to the service.

Siemens provides a firmware update for the latest version of LOGO!8 devices. For older versions, the device needs to be upgraded (see table below).