SB2020041516 - Business Logic Errors in Siemens SIMOTICS, Desigo, APOGEE, and TALON

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020041516

SB2020041516 - Business Logic Errors in Siemens SIMOTICS, Desigo, APOGEE, and TALON

Published: April 15, 2020

Security Bulletin ID SB2020041516
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Business Logic Errors (CVE-ID: CVE-2019-13939)

CWE-ID: CWE-840 - Business Logic Errors (3.0)

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to change the IP address of the device to an invalid value.

The vulnerability exists due to logical errors. A remote attacker on the local network can make device configuration changes and affect its availability.

This vulnerability affects the following products and versions:
  • APOGEE MEC/MBC/PXC (P2): All versions prior to 2.8.2
  • APOGEE PXC Series (BACnet): All versions, 3.0 and newer
  • APOGEE PCX Series (P2): All versions, 2.8.2 and newer
  • Desigo PXC (Power PC): All versions, 2.3x and newer
  • Desigo PXM20 (Power PC): All versions, 2.3x and newer
  • SIMOTICS CONNECT 400: All versions prior to 0.3.0.330
  • TALON TC Series (BACnet): All versions, 3.0 and newer

Remediation

Install update from vendor's website.

References