CVE-2014-2250
HighSummary
The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, making it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions.
Risk Assessment
The organization may be exposed to attacks that could lead to session hijacking and data compromise, threatening the integrity of industrial automation systems.
Recommendation
It is recommended to update the firmware to version 4.0 or later to enhance the security of the random-number generator.
Other vulnerabilities in Siemens SIMATIC S7-1200 CPU PLC
See all- CVE-2014-2258High
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before version 4.0 are vulnerable to remote attacks that can lead to denial of service via crafted HTTPS packets.
- CVE-2014-2256High
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before version 4.0 are vulnerable to remote attacks that can lead to denial of service via crafted ISO-TSAP packets.
- CVE-2014-2254High
Siemens SIMATIC S7-1200 CPU PLC devices with firmware before version 4.0 are vulnerable to remote attacks that can lead to denial of service via crafted HTTP packets.
Original NVD description (English source)
The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.