« Volver al listado

CVE-2014-2250

Estado: ModificadaAlta (8.3)—

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Siemens — Simatic S7 Cpu-1211cSiemens — Simatic S7 CPU 1200 FirmwareSiemens — Simatic S7 CPU 1212cSiemens — Simatic S7 CPU 1214cSiemens — Simatic S7 CPU 1215cSiemens — Simatic S7 CPU 1217c

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-2250",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:C",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 8.5,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-03-24T14:20:39.557",
  "references": [
    {
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251."
    },
    {
      "lang": "es",
      "value": "El generador de números aleatorios en dispositivos de Siemens SIMATIC S7-1200 CPU PLC con firmware anterior a 4.0 no tiene suficiente entropía, lo que facilita a atacantes remotos anular mecanismos de protección criptográfica y secuestrar sesiones a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2251."
    }
  ],
  "lastModified": "2026-06-17T00:06:17.737",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BCF4722-1850-48CD-9BCA-6EBD9EFF8147",
              "versionEndIncluding": "3.0.2"
            },
            {
              "criteria": "cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8C7A9D3-33C0-465B-914D-3D1FF1BE8272"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_cpu-1211c:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7F8E0D6-D9DE-4F2A-A0D3-84A9EEB8EAFD"
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1212c:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6A11F4A-4DA2-4EDC-A51F-69DA422C320F"
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1214c:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EB6306C-2F6E-49A3-BFAE-BA6962501697"
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1215c:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DC6AAEF-22EE-449B-83A8-9BE0B84199EE"
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1217c:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36F69756-6304-489F-A287-65D0A9E81943"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}