« Volver al listado

CVE-2019-6584

Estado: ModificadaAlta (8.8)—

A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out.

Leer descripción completaMostrar menos

The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Siemens — Logo!8 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-6584",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens AG",
          "product": "SIEMENS LOGO!8",
          "versions": [
            {
              "status": "affected",
              "version": "6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx"
            }
          ]
        },
        {
          "vendor": "Siemens AG",
          "product": "SIEMENS LOGO!8",
          "versions": [
            {
              "status": "affected",
              "version": "6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-12T14:29:06.117",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version < V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido identificada en LOGO! 8 de SIEMENS (6ED1052-xyyxx-0BA8 FS:01 a FS:06 / versión de firmware V1.80.xx y V1.81.xx), SIEMENS LOGO! 8 (6ED1052-xyy08-0BA0 FS:01 / Versión de firmware < V1.82.02). El servidor web integrado no invalida el ID de sesión durante el cierre de sesión del usuario. Un atacante que haya extraído con éxito un ID de sesión válido puede usarlo incluso luego de que el usuario cierre la sesión. La vulnerabilidad de la seguridad puede ser explotada por un atacante en una posición de red privilegiada que puede leer la comunicación entre el dispositivo afectado y el usuario o por un atacante que puede obtener una ID de sesión válida mediante otros medios. El usuario necesita invocar una sesión al dispositivo afectado. En el momento de la publicación de asesoramiento, no se conocía la explotación pública de esta vulnerabilidad de seguridad."
    }
  ],
  "lastModified": "2026-06-17T02:39:18.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3263ABC4-B0EB-409B-96ED-1A751757999F",
              "versionEndIncluding": "1.81.00",
              "versionStartIncluding": "1.80.00"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1769E8B8-0B40-4E85-B52C-52FA4907D610"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D867D890-22A1-461E-8BEE-9EEFF633633E",
              "versionEndExcluding": "1.82.00"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1769E8B8-0B40-4E85-B52C-52FA4907D610"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}