CVE-2017-12734

High

Published: 30/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) in all versions below V1.81.2. An attacker with network access could obtain the session ID of an active user session when the user is logged into the web interface.

Risk Assessment

This vulnerability may lead to unauthorized access to user sessions, posing a risk of system takeover. Specifically, an attacker in a trusted network could exploit this flaw.

Recommendation

It is recommended to use the integrated web server only in trusted networks and to update the software to version V1.81.2 or newer.

Other vulnerabilities in LOGO! 8 BM (w tym warianty SIPLUS)

CVE-2017-12735High
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) in all versions below V8.3. An attacker performing a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic.

Original NVD description (English source)

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use the integrated webserver on port 80/tcp only in trusted networks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS