Vulnerability identifier: #VU9701

Vulnerability risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-12740

CWE-ID: CWE-300

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
LOGO! Soft Comfort
Client/Desktop applications / Other client software

Vendor: Siemens

Description
The vulnerability allows a remote attacker to conduct man-in-the-middle attack.

The weakness exists due to lack of integrity verification on software packages downloaded via an unprotected communication channel. A remote attacker can use man-in-the-middle technique and manipulate the software package.

Mitigation
Update to version 8.2.

Vulnerable software versions

LOGO! Soft Comfort: All versions

---

External links
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-888929.pdf

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.