Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-10050 (GCVE-0-2020-10050)
Vulnerability from cvelistv5 – Published: 2020-09-09 18:08 – Updated: 2024-08-04 10:50
VLAI?
EPSS
Summary
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.
Severity ?
No CVSS data available.
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Siemens AG | SIMATIC RTLS Locating Manager |
Affected:
All versions < V2.10.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:50:57.813Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SIMATIC RTLS Locating Manager",
"vendor": "Siemens AG",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V2.10.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-09T18:08:43",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2020-10050",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SIMATIC RTLS Locating Manager",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V2.10.2"
}
]
}
}
]
},
"vendor_name": "Siemens AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-276: Incorrect Default Permissions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2020-10050",
"datePublished": "2020-09-09T18:08:43",
"dateReserved": "2020-03-04T00:00:00",
"dateUpdated": "2024-08-04T10:50:57.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.10.2\", \"matchCriteriaId\": \"FB5582A7-B6F3-4A5D-AC0E-C278D351F2B9\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad en SIMATIC RTLS Locating Manager (todas las versiones anteriores a V2.10.2).\u0026#xa0;El directorio de servicios ejecutables de la aplicaci\\u00f3n afectada podr\\u00eda permitir a un atacante local incluir comandos arbitrarios que se ejecutan con privilegios SYSTEM cuando el sistema se reinicia.\"}]",
"id": "CVE-2020-10050",
"lastModified": "2024-11-21T04:54:42.407",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 7.2, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 3.9, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2020-09-09T19:15:18.413",
"references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf\", \"source\": \"productcert@siemens.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"productcert@siemens.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-276\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-276\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-10050\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2020-09-09T19:15:18.413\",\"lastModified\":\"2024-11-21T04:54:42.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en SIMATIC RTLS Locating Manager (todas las versiones anteriores a V2.10.2).\u0026#xa0;El directorio de servicios ejecutables de la aplicaci\u00f3n afectada podr\u00eda permitir a un atacante local incluir comandos arbitrarios que se ejecutan con privilegios SYSTEM cuando el sistema se reinicia.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.10.2\",\"matchCriteriaId\":\"FB5582A7-B6F3-4A5D-AC0E-C278D351F2B9\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
CERTFR-2020-AVI-550
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SPPA-S2000 (S7) | ||
| Siemens | N/A | SINEMA Remote Connect | ||
| Siemens | N/A | SIMATIC HMI United Comfort Panels | ||
| Siemens | N/A | Polarion Subversion Webclient | ||
| Siemens | N/A | Siveillance Video Client toutes versions sans le dernier correctif de sécurité | ||
| Siemens | N/A | Process Historian | ||
| Siemens | N/A | SIMATIC, SIMOTION et SINUMERIK (voir le site du constructeur pour les versions vulnérables, cf. section Documentation) | ||
| Siemens | N/A | SIMATIC WinCC OA | ||
| Siemens | N/A | SIMATIC HMI Basic Panels 2nd Generation versions antérieures à 14 | ||
| Siemens | N/A | SPPA-T3000 | ||
| Siemens | N/A | SPPA-S3000 | ||
| Siemens | N/A | SIMATIC S7-300 CPU family | ||
| Siemens | N/A | License Management Utility (LMU) versions antérieures à 2.4 | ||
| Siemens | N/A | SIMATIC RTLS Locating Manager versions antérieures à V2.10.2 | ||
| Siemens | N/A | SIMATIC PCS neo | ||
| Siemens | N/A | Spectrum Power 4 versions antérieures à 4.70 SP8 | ||
| Siemens | N/A | Information Server | ||
| Siemens | N/A | SIMATIC HMI Comfort Panels | ||
| Siemens | N/A | SINEC INS | ||
| Siemens | N/A | SIMATIC HMI Mobile Panels | ||
| Siemens | N/A | SIMIT Simulation Platform | ||
| Siemens | N/A | SIMATIC S7-400 CPU family |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SPPA-S2000 (S7)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI United Comfort Panels",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Polarion Subversion Webclient",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Video Client toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Process Historian",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC, SIMOTION et SINUMERIK (voir le site du constructeur pour les versions vuln\u00e9rables, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC OA",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Basic Panels 2nd Generation versions ant\u00e9rieures \u00e0 14",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SPPA-T3000",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SPPA-S3000",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-300 CPU family",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "License Management Utility (LMU) versions ant\u00e9rieures \u00e0 2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RTLS Locating Manager versions ant\u00e9rieures \u00e0 V2.10.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS neo",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power 4 versions ant\u00e9rieures \u00e0 4.70 SP8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Information Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Comfort Panels",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC INS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Mobile Panels",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMIT Simulation Platform",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-400 CPU family",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-15788",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15788"
},
{
"name": "CVE-2020-14515",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
},
{
"name": "CVE-2020-14513",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
},
{
"name": "CVE-2020-10050",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10050"
},
{
"name": "CVE-2020-10056",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10056"
},
{
"name": "CVE-2020-15791",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15791"
},
{
"name": "CVE-2020-15786",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15786"
},
{
"name": "CVE-2020-15785",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15785"
},
{
"name": "CVE-2020-14517",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
},
{
"name": "CVE-2020-14519",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
},
{
"name": "CVE-2020-15790",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15790"
},
{
"name": "CVE-2020-15789",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15789"
},
{
"name": "CVE-2020-10049",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10049"
},
{
"name": "CVE-2020-15787",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15787"
},
{
"name": "CVE-2020-14509",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
},
{
"name": "CVE-2020-10051",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10051"
},
{
"name": "CVE-2020-15784",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15784"
},
{
"name": "CVE-2020-16233",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
},
{
"name": "CVE-2020-0543",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-0543"
}
],
"links": [],
"reference": "CERTFR-2020-AVI-550",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-09-08T00:00:00.000000"
},
{
"description": "Ajout du lien vers les produits Siemens Energy (https://cert-portal.siemens.com/productcert/html/ssa-455844.html)",
"revision_date": "2022-02-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-568969 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455844 du 17 f\u00e9vrier 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-455844.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455843 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-251935 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-436520 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-381684 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-770698 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-709003 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-542525 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-534763 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-534763.pdf"
}
]
}
CERTFR-2020-AVI-550
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SPPA-S2000 (S7) | ||
| Siemens | N/A | SINEMA Remote Connect | ||
| Siemens | N/A | SIMATIC HMI United Comfort Panels | ||
| Siemens | N/A | Polarion Subversion Webclient | ||
| Siemens | N/A | Siveillance Video Client toutes versions sans le dernier correctif de sécurité | ||
| Siemens | N/A | Process Historian | ||
| Siemens | N/A | SIMATIC, SIMOTION et SINUMERIK (voir le site du constructeur pour les versions vulnérables, cf. section Documentation) | ||
| Siemens | N/A | SIMATIC WinCC OA | ||
| Siemens | N/A | SIMATIC HMI Basic Panels 2nd Generation versions antérieures à 14 | ||
| Siemens | N/A | SPPA-T3000 | ||
| Siemens | N/A | SPPA-S3000 | ||
| Siemens | N/A | SIMATIC S7-300 CPU family | ||
| Siemens | N/A | License Management Utility (LMU) versions antérieures à 2.4 | ||
| Siemens | N/A | SIMATIC RTLS Locating Manager versions antérieures à V2.10.2 | ||
| Siemens | N/A | SIMATIC PCS neo | ||
| Siemens | N/A | Spectrum Power 4 versions antérieures à 4.70 SP8 | ||
| Siemens | N/A | Information Server | ||
| Siemens | N/A | SIMATIC HMI Comfort Panels | ||
| Siemens | N/A | SINEC INS | ||
| Siemens | N/A | SIMATIC HMI Mobile Panels | ||
| Siemens | N/A | SIMIT Simulation Platform | ||
| Siemens | N/A | SIMATIC S7-400 CPU family |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SPPA-S2000 (S7)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI United Comfort Panels",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Polarion Subversion Webclient",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Video Client toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Process Historian",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC, SIMOTION et SINUMERIK (voir le site du constructeur pour les versions vuln\u00e9rables, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC WinCC OA",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Basic Panels 2nd Generation versions ant\u00e9rieures \u00e0 14",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SPPA-T3000",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SPPA-S3000",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-300 CPU family",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "License Management Utility (LMU) versions ant\u00e9rieures \u00e0 2.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RTLS Locating Manager versions ant\u00e9rieures \u00e0 V2.10.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC PCS neo",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Spectrum Power 4 versions ant\u00e9rieures \u00e0 4.70 SP8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Information Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Comfort Panels",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC INS",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC HMI Mobile Panels",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMIT Simulation Platform",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC S7-400 CPU family",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-15788",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15788"
},
{
"name": "CVE-2020-14515",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
},
{
"name": "CVE-2020-14513",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
},
{
"name": "CVE-2020-10050",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10050"
},
{
"name": "CVE-2020-10056",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10056"
},
{
"name": "CVE-2020-15791",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15791"
},
{
"name": "CVE-2020-15786",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15786"
},
{
"name": "CVE-2020-15785",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15785"
},
{
"name": "CVE-2020-14517",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
},
{
"name": "CVE-2020-14519",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
},
{
"name": "CVE-2020-15790",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15790"
},
{
"name": "CVE-2020-15789",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15789"
},
{
"name": "CVE-2020-10049",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10049"
},
{
"name": "CVE-2020-15787",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15787"
},
{
"name": "CVE-2020-14509",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
},
{
"name": "CVE-2020-10051",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10051"
},
{
"name": "CVE-2020-15784",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15784"
},
{
"name": "CVE-2020-16233",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
},
{
"name": "CVE-2020-0543",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-0543"
}
],
"links": [],
"reference": "CERTFR-2020-AVI-550",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-09-08T00:00:00.000000"
},
{
"description": "Ajout du lien vers les produits Siemens Energy (https://cert-portal.siemens.com/productcert/html/ssa-455844.html)",
"revision_date": "2022-02-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-568969 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455844 du 17 f\u00e9vrier 2022",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-455844.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455843 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-251935 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-436520 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-381684 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-770698 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-709003 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-542525 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-534763 du 08 septembre 2020",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-534763.pdf"
}
]
}
VAR-202009-0052
Vulnerability from variot - Updated: 2023-12-18 10:57A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts. SIMATIC RTLS Locating Manager Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SIMATIC RTLS is a real-time wireless positioning system for positioning solutions. Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installation
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202009-0052",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "simatic rtls locating manager",
"scope": "lt",
"trust": 1.6,
"vendor": "siemens",
"version": "2.10.2"
},
{
"model": "simatic rtls locating manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": "2.10.2"
},
{
"model": "simatic rtls locating manager",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "NVD",
"id": "CVE-2020-10050"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.10.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10050"
}
]
},
"cve": "CVE-2020-10050",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.2,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2020-10050",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2020-51250",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2020-10050",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-10050",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2020-51250",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202009-511",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts. SIMATIC RTLS Locating Manager Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. SIMATIC RTLS is a real-time wireless positioning system for positioning solutions. Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installation",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "CNVD",
"id": "CNVD-2020-51250"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-10050",
"trust": 3.8
},
{
"db": "SIEMENS",
"id": "SSA-251935",
"trust": 2.2
},
{
"db": "ICS CERT",
"id": "ICSA-20-252-01",
"trust": 1.4
},
{
"db": "JVN",
"id": "JVNVU94568336",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-51250",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.3078",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "50589",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202009-511",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"id": "VAR-202009-0052",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
}
],
"trust": 0.975
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
}
]
},
"last_update_date": "2023-12-18T10:57:38.660000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-251935",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
},
{
"title": "Patch for Siemens SIMATIC RTLS Locating Manager Privilege Escalation Vulnerability (CNVD-2020-51250)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/233320"
},
{
"title": "ARC Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=127930"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-276",
"trust": 1.0
},
{
"problemtype": "Inappropriate default permissions (CWE-276) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "NVD",
"id": "CVE-2020-10050"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10050"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-252-01"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu94568336/"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/50589"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3078/"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/siemens-simatic-rtls-locating-manager-privilege-escalation-33284"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-09-09T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"date": "2021-02-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"date": "2020-09-09T19:15:18.413000",
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"date": "2020-09-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-09-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-51250"
},
{
"date": "2022-03-11T06:10:00",
"db": "JVNDB",
"id": "JVNDB-2020-010866"
},
{
"date": "2020-09-14T19:06:58.930000",
"db": "NVD",
"id": "CVE-2020-10050"
},
{
"date": "2020-11-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SIMATIC\u00a0RTLS\u00a0Locating\u00a0Manager\u00a0 Inappropriate Default Permission Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010866"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202009-511"
}
],
"trust": 0.6
}
}
GSD-2020-10050
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-10050",
"description": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.",
"id": "GSD-2020-10050"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-10050"
],
"details": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.",
"id": "GSD-2020-10050",
"modified": "2023-12-13T01:22:04.084666Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2020-10050",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SIMATIC RTLS Locating Manager",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V2.10.2"
}
]
}
}
]
},
"vendor_name": "Siemens AG"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-276: Incorrect Default Permissions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.10.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2020-10050"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2020-09-14T19:06Z",
"publishedDate": "2020-09-09T19:15Z"
}
}
}
FKIE_CVE-2020-10050
Vulnerability from fkie_nvd - Published: 2020-09-09 19:15 - Updated: 2024-11-21 04:54
Severity ?
Summary
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| siemens | simatic_rtls_locating_manager | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:simatic_rtls_locating_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5582A7-B6F3-4A5D-AC0E-C278D351F2B9",
"versionEndExcluding": "2.10.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en SIMATIC RTLS Locating Manager (todas las versiones anteriores a V2.10.2).\u0026#xa0;El directorio de servicios ejecutables de la aplicaci\u00f3n afectada podr\u00eda permitir a un atacante local incluir comandos arbitrarios que se ejecutan con privilegios SYSTEM cuando el sistema se reinicia."
}
],
"id": "CVE-2020-10050",
"lastModified": "2024-11-21T04:54:42.407",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-09T19:15:18.413",
"references": [
{
"source": "productcert@siemens.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
],
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "productcert@siemens.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-666M-7M3W-F97C
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-05-24 17:27
VLAI?
Details
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.
{
"affected": [],
"aliases": [
"CVE-2020-10050"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-09T19:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \u003c V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.",
"id": "GHSA-666m-7m3w-f97c",
"modified": "2022-05-24T17:27:36Z",
"published": "2022-05-24T17:27:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10050"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
CNVD-2020-51250
Vulnerability from cnvd - Published: 2020-09-09
VLAI Severity ?
Title
Siemens SIMATIC RTLS Locating Manager权限提升漏洞（CNVD-2020-51250）
Description
SIMATIC RTLS是用于定位解决方案的实时无线定位系统。Siemens SIMATIC RTLS Locating Manager用于SIMATIC RTLS安装的配置，操作和维护。
Siemens SIMATIC RTLS Locating Manager存在权限提升漏洞。攻击者可利用漏洞在系统重新启动时以SYSTEM特权执行的任意命令。
Severity
中
Patch Name
Siemens SIMATIC RTLS Locating Manager权限提升漏洞（CNVD-2020-51250）的补丁
Patch Description
SIMATIC RTLS是用于定位解决方案的实时无线定位系统。Siemens SIMATIC RTLS Locating Manager用于SIMATIC RTLS安装的配置，操作和维护。
Siemens SIMATIC RTLS Locating Manager存在权限提升漏洞。攻击者可利用漏洞在系统重新启动时以SYSTEM特权执行的任意命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf
Reference
https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf
Impacted products
| Name | Siemens SIMATIC RTLS Locating Manager <2.10.2 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-10050"
}
},
"description": "SIMATIC RTLS\u662f\u7528\u4e8e\u5b9a\u4f4d\u89e3\u51b3\u65b9\u6848\u7684\u5b9e\u65f6\u65e0\u7ebf\u5b9a\u4f4d\u7cfb\u7edf\u3002Siemens SIMATIC RTLS Locating Manager\u7528\u4e8eSIMATIC RTLS\u5b89\u88c5\u7684\u914d\u7f6e\uff0c\u64cd\u4f5c\u548c\u7ef4\u62a4\u3002\n\nSiemens SIMATIC RTLS Locating Manager\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u7cfb\u7edf\u91cd\u65b0\u542f\u52a8\u65f6\u4ee5SYSTEM\u7279\u6743\u6267\u884c\u7684\u4efb\u610f\u547d\u4ee4\u3002",
"formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-51250",
"openTime": "2020-09-09",
"patchDescription": "SIMATIC RTLS\u662f\u7528\u4e8e\u5b9a\u4f4d\u89e3\u51b3\u65b9\u6848\u7684\u5b9e\u65f6\u65e0\u7ebf\u5b9a\u4f4d\u7cfb\u7edf\u3002Siemens SIMATIC RTLS Locating Manager\u7528\u4e8eSIMATIC RTLS\u5b89\u88c5\u7684\u914d\u7f6e\uff0c\u64cd\u4f5c\u548c\u7ef4\u62a4\u3002\r\n\r\nSiemens SIMATIC RTLS Locating Manager\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u7cfb\u7edf\u91cd\u65b0\u542f\u52a8\u65f6\u4ee5SYSTEM\u7279\u6743\u6267\u884c\u7684\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Siemens SIMATIC RTLS Locating Manager\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2020-51250\uff09\u7684\u8865\u4e01",
"products": {
"product": "Siemens SIMATIC RTLS Locating Manager \u003c2.10.2"
},
"referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf",
"serverity": "\u4e2d",
"submitTime": "2020-09-09",
"title": "Siemens SIMATIC RTLS Locating Manager\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2020-51250\uff09"
}
ICSA-20-252-01
Vulnerability from csaf_cisa - Published: 2020-09-08 00:00 - Updated: 2020-09-08 00:00Summary
Siemens SIMATIC RTLS Locating Manager
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of this vulnerability could allow a privileged local user to escalate privileges.
Critical infrastructure sectors
Critical Manufacturing, Transportation Systems
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:
https://www.siemens.com/cert/advisories
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Exploitability
No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of this vulnerability could allow a privileged local user to escalate privileges.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Critical Manufacturing, Transportation Systems",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and \nsolutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-20-252-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-252-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-20-252-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-252-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-252-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B"
},
{
"category": "external",
"summary": "SSA-496604: SSA-251935: Multiple Privilege Escalation Vulnerabilities in SIMATIC RTLS Locating Manager - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/SSA-251935.txt"
}
],
"title": "Siemens SIMATIC RTLS Locating Manager",
"tracking": {
"current_release_date": "2020-09-08T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-20-252-01",
"initial_release_date": "2020-09-08T00:00:00.000000Z",
"revision_history": [
{
"date": "2020-09-08T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-20-252-01 Siemens SIMATIC RTLS Locating Manager"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "All versions \u003c V2.10.2",
"product": {
"name": "SIMATIC RTLS Locating Manager: All versions \u003c V2.10.2",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIMATIC RTLS Locating Manager"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-10049",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system administrators.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "https://support.industry.siemens.com/cs/ww/en/view/109781166",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781166"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10049"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Apply security hardening of the Windows Server, where the RTLS Locating\nManager is installed on, in accordance with your corporate security\npolicies or up-to-date hardening guidelines",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Ensure that only trusted persons have access to the system and avoid the\nconfiguration of additional local accounts on the server",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.10.2 - Download: https://support.industry.siemens.com/cs/ww/en/view/109781166 ",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781166"
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-10050",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "https://support.industry.siemens.com/cs/ww/en/view/109781166",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781166"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10050"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Apply security hardening of the Windows Server, where the RTLS Locating\nManager is installed on, in accordance with your corporate security\npolicies or up-to-date hardening guidelines",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Ensure that only trusted persons have access to the system and avoid the\nconfiguration of additional local accounts on the server",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.10.2 - Download: https://support.industry.siemens.com/cs/ww/en/view/109781166 ",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781166"
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-10051",
"cwe": {
"id": "CWE-428",
"name": "Unquoted Search Path or Element"
},
"notes": [
{
"category": "summary",
"text": "Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "https://support.industry.siemens.com/cs/ww/en/view/109781166",
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781166"
},
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10051"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Apply security hardening of the Windows Server, where the RTLS Locating\nManager is installed on, in accordance with your corporate security\npolicies or up-to-date hardening guidelines",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Ensure that only trusted persons have access to the system and avoid the\nconfiguration of additional local accounts on the server",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Update to V2.10.2 - Download: https://support.industry.siemens.com/cs/ww/en/view/109781166 ",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109781166"
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…