{
  "GSD": {
    "alias": "CVE-2019-6584",
    "description": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known.",
    "id": "GSD-2019-6584"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-6584"
      ],
      "details": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known.",
      "id": "GSD-2019-6584",
      "modified": "2023-12-13T01:23:49.511935Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "productcert@siemens.com",
        "ID": "CVE-2019-6584",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "SIEMENS LOGO!8",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "SIEMENS LOGO!8",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Siemens AG"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-384: Session Fixation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "1.81.00",
                    "versionStartIncluding": "1.80.00",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.82.00",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2019-6584"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-613"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-09-29T00:30Z",
      "publishedDate": "2019-06-12T14:29Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3263ABC4-B0EB-409B-96ED-1A751757999F",
              "versionEndIncluding": "1.81.00",
              "versionStartIncluding": "1.80.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1769E8B8-0B40-4E85-B52C-52FA4907D610",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D867D890-22A1-461E-8BEE-9EEFF633633E",
              "versionEndExcluding": "1.82.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1769E8B8-0B40-4E85-B52C-52FA4907D610",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido identificada en LOGO! 8 de SIEMENS (6ED1052-xyyxx-0BA8 FS:01 a FS:06 / versi\u00f3n de firmware V1.80.xx y V1.81.xx), SIEMENS LOGO! 8 (6ED1052-xyy08-0BA0 FS:01 / Versi\u00f3n de firmware \u003c V1.82.02). El servidor web integrado no invalida el ID de sesi\u00f3n durante el cierre de sesi\u00f3n del usuario. Un atacante que haya extra\u00eddo con \u00e9xito un ID de sesi\u00f3n v\u00e1lido puede usarlo incluso luego de que el usuario cierre la sesi\u00f3n. La vulnerabilidad de la seguridad puede ser explotada por un atacante en una posici\u00f3n de red privilegiada que puede leer la comunicaci\u00f3n entre el dispositivo afectado y el usuario o por un atacante que puede obtener una ID de sesi\u00f3n v\u00e1lida mediante otros medios. El usuario necesita invocar una sesi\u00f3n al dispositivo afectado. En el momento de la publicaci\u00f3n de asesoramiento, no se conoc\u00eda la explotaci\u00f3n p\u00fablica de esta vulnerabilidad de seguridad."
    }
  ],
  "id": "CVE-2019-6584",
  "lastModified": "2024-11-21T04:46:45.083",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-06-12T14:29:06.117",
  "references": [
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201906-0207",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "logo\\!8",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.81.00"
      },
      {
        "model": "logo\\!8",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.80.00"
      },
      {
        "model": "logo\\!8",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.82.00"
      },
      {
        "model": "logo!8",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "siemens",
        "version": "1.82.01"
      },
      {
        "model": "6ed1052-1cc08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-1fb08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-1hb08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-1md08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-2cc08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-2fb00-0ba8",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-2fb08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-2hb08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-2md00-0ba8",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "6ed1052-2md08-0ba0",
        "scope": null,
        "trust": 0.8,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "6ed1052 1fb00 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "6ed1052 1fb00 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "6ed1052 2md00 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "6ed1052 2md00 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": "logo!8",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "siemens",
        "version": "1.82.02"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1cc08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2fb00 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2fb00 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2hb00 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2hb00 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1md00 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1md00 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2cc01 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2cc01 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1cc01 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1cc01 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1hb00 0ba8",
        "version": "1.80.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1hb00 0ba8",
        "version": "1.81.xx"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1fb08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1hb08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 1md08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2cc08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2fb08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2hb08 0ba0",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "6ed1052 2md08 0ba0",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "BID",
        "id": "108728"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "1.81.00",
                    "versionStartIncluding": "1.80.00",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:logo\\!8_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "1.82.00",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:logo\\!8:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "and Christian Siemers and Irakli Edjibia from Hochschule Augsburg reported these vulnerabilities to Siemens., and Christian Siemers and Irakli Edjibia from Hochschule Augsburg,Christian Siemers and Irakli Edjibia from Hochschule Augsburg,Thomas Meesters from cirosec GmbH and Ruhr University of Bochum",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2019-6584",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 6.8,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2019-6584",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "CNVD-2019-17150",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-158019",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-6584",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-6584",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2019-17150",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201906-519",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "IVD",
            "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac",
            "trust": 0.2,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-158019",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known. SIEMENS LOGO!8 Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LOGO!8 is the 8th generation intelligent logic controller of Siemens. It is the NanoPLC in the Siemens PLC family. It simplifies the programming configuration, the integrated panel can display more content, and can be easily integrated efficiently through the integrated Ethernet interface. interconnected. An authorization issue vulnerability exists in SiemensLOGO!8. The vulnerability stems from a lack of authentication in the network system or product or insufficient strength of authentication. Siemens LOGO!8 Devices are prone to multiple security vulnerabilities. \nAn attacker can exploit these issues to hijack an arbitrary session and gain unauthorized access to the affected application or cause a denial of service condition",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "BID",
        "id": "108728"
      },
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6584",
        "trust": 3.6
      },
      {
        "db": "SIEMENS",
        "id": "SSA-774850",
        "trust": 2.3
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-19-162-03",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519",
        "trust": 0.9
      },
      {
        "db": "BID",
        "id": "108728",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "A71663A7-E7EF-47E6-B187-0B2DC39D78AC",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "db": "BID",
        "id": "108728"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "id": "VAR-201906-0207",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      }
    ],
    "trust": 1.7333333
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:13:27.086000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SSA-774850",
        "trust": 0.8,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
      },
      {
        "title": "Patch for SiemensLOGO!8 Authorization Issue Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/163435"
      },
      {
        "title": "Siemens LOGO!8 Fixes for access control error vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=93753"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-613",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-284",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
      },
      {
        "trust": 0.9,
        "url": "http://www.siemens.com/"
      },
      {
        "trust": 0.9,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-19-162-03"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6584"
      },
      {
        "trust": 0.8,
        "url": "https://www.us-cert.gov/ics/advisories/icsa-19-162-03"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6584"
      },
      {
        "trust": 0.6,
        "url": "https://www.securityfocus.com/bid/108728"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "db": "BID",
        "id": "108728"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "db": "BID",
        "id": "108728"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-06-13T00:00:00",
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "date": "2019-06-13T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "date": "2019-06-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "date": "2019-06-11T00:00:00",
        "db": "BID",
        "id": "108728"
      },
      {
        "date": "2019-06-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "date": "2019-06-12T14:29:06.117000",
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "date": "2019-06-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-06-13T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      },
      {
        "date": "2020-09-29T00:00:00",
        "db": "VULHUB",
        "id": "VHN-158019"
      },
      {
        "date": "2019-06-11T00:00:00",
        "db": "BID",
        "id": "108728"
      },
      {
        "date": "2019-07-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-005570"
      },
      {
        "date": "2020-09-29T00:30:23.317000",
        "db": "NVD",
        "id": "CVE-2019-6584"
      },
      {
        "date": "2020-10-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Siemens LOGO!8 Authorization Issue Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "a71663a7-e7ef-47e6-b187-0b2dc39d78ac"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-17150"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-519"
      }
    ],
    "trust": 0.6
  }
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SIMATIC Ident MV420",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIEMENS LOGO!8 versions ant\u00e9rieures \u00e0 V1.82.02",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-200IRT",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-200 versions ant\u00e9rieures \u00e0 V5.2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-200RNA versions ant\u00e9rieures \u00e0 V3.2.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC Ident MV440",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-300",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2018 R2 versions ant\u00e9rieures \u00e0 V12.2a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2018 R1 versions ant\u00e9rieures \u00e0 V12.1a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2019 R1 versions ant\u00e9rieures \u00e0 V13.1a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2017 R2 versions ant\u00e9rieures \u00e0 V11.2a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-414-3E",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2018 R3 versions ant\u00e9rieures \u00e0 V12.3a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6584"
    },
    {
      "name": "CVE-2019-6567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6567"
    },
    {
      "name": "CVE-2019-6580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6580"
    },
    {
      "name": "CVE-2018-4833",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-4833"
    },
    {
      "name": "CVE-2019-10926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10926"
    },
    {
      "name": "CVE-2019-6571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6571"
    },
    {
      "name": "CVE-2019-10925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10925"
    },
    {
      "name": "CVE-2019-6581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6581"
    },
    {
      "name": "CVE-2019-6582",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6582"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-256",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-774850 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-816980 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-646841 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-646841.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-181018 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-181018.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-212009 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SIMATIC Ident MV420",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIEMENS LOGO!8 versions ant\u00e9rieures \u00e0 V1.82.02",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-200IRT",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-200 versions ant\u00e9rieures \u00e0 V5.2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-200RNA versions ant\u00e9rieures \u00e0 V3.2.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC Ident MV440",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-300",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2018 R2 versions ant\u00e9rieures \u00e0 V12.2a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2018 R1 versions ant\u00e9rieures \u00e0 V12.1a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2019 R1 versions ant\u00e9rieures \u00e0 V13.1a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2017 R2 versions ant\u00e9rieures \u00e0 V11.2a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SCALANCE X-414-3E",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance VMS 2018 R3 versions ant\u00e9rieures \u00e0 V12.3a",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6584"
    },
    {
      "name": "CVE-2019-6567",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6567"
    },
    {
      "name": "CVE-2019-6580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6580"
    },
    {
      "name": "CVE-2018-4833",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-4833"
    },
    {
      "name": "CVE-2019-10926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10926"
    },
    {
      "name": "CVE-2019-6571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6571"
    },
    {
      "name": "CVE-2019-10925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10925"
    },
    {
      "name": "CVE-2019-6581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6581"
    },
    {
      "name": "CVE-2019-6582",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6582"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-256",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-774850 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-816980 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-816980.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-646841 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-646841.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-181018 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-181018.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-212009 du 11 juin 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-212009.pdf"
    }
  ]
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-6584"
    }
  },
  "description": "LOGO!8\u662f\u897f\u95e8\u5b50\u7b2c8\u4ee3\u667a\u80fd\u903b\u8f91\u63a7\u5236\u5668\uff0c\u662f\u897f\u95e8\u5b50PLC\u5bb6\u65cf\u91cc\u7684Nano PLC\uff0c\u5b83\u7b80\u5316\u4e86\u7f16\u7a0b\u7ec4\u6001\uff0c\u96c6\u6210\u7684\u9762\u677f\u53ef\u663e\u793a\u66f4\u591a\u7684\u5185\u5bb9\uff0c\u5e76\u53ef\u901a\u8fc7\u96c6\u6210\u7684\u4ee5\u592a\u7f51\u63a5\u53e3\u8f7b\u677e\u7ec4\u7f51\u9ad8\u6548\u4e92\u8054\u3002\n\nSiemens LOGO!8\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u4e2d\u7f3a\u5c11\u8eab\u4efd\u9a8c\u8bc1\u63aa\u65bd\u6216\u8eab\u4efd\u9a8c\u8bc1\u5f3a\u5ea6\u4e0d\u8db3\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u53d7\u5f71\u54cd\u8bbe\u5907\u4e0e\u7528\u6237\u4e4b\u95f4\u7684\u901a\u4fe1\uff0c\u6216\u901a\u8fc7\u5176\u4ed6M\u83b7\u53d6\u6709\u6548\u4f1a\u8bddID\u7684\u653b\u51fb\u8005\u3002",
  "discovererName": "Thomas Meesters from cirosec GmbH and Ruhr University of Bochum, and Christian Siemers and Irakli Edjibia from Hochschule Augsburg",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.industry.siemens.com/cs/ww/en/view/109767410",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-17150",
  "openTime": "2019-06-13",
  "patchDescription": "LOGO!8\u662f\u897f\u95e8\u5b50\u7b2c8\u4ee3\u667a\u80fd\u903b\u8f91\u63a7\u5236\u5668\uff0c\u662f\u897f\u95e8\u5b50PLC\u5bb6\u65cf\u91cc\u7684Nano PLC\uff0c\u5b83\u7b80\u5316\u4e86\u7f16\u7a0b\u7ec4\u6001\uff0c\u96c6\u6210\u7684\u9762\u677f\u53ef\u663e\u793a\u66f4\u591a\u7684\u5185\u5bb9\uff0c\u5e76\u53ef\u901a\u8fc7\u96c6\u6210\u7684\u4ee5\u592a\u7f51\u63a5\u53e3\u8f7b\u677e\u7ec4\u7f51\u9ad8\u6548\u4e92\u8054\u3002\r\n\r\nSiemens LOGO!8\u4e2d\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u4e2d\u7f3a\u5c11\u8eab\u4efd\u9a8c\u8bc1\u63aa\u65bd\u6216\u8eab\u4efd\u9a8c\u8bc1\u5f3a\u5ea6\u4e0d\u8db3\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u53d7\u5f71\u54cd\u8bbe\u5907\u4e0e\u7528\u6237\u4e4b\u95f4\u7684\u901a\u4fe1\uff0c\u6216\u901a\u8fc7\u5176\u4ed6M\u83b7\u53d6\u6709\u6548\u4f1a\u8bddID\u7684\u653b\u51fb\u8005\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens LOGO!8\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Siemens LOGO!8 1.82.01"
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2019-06-12",
  "title": "Siemens LOGO!8\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      },
      {
        "names": [
          "Thomas Meesters"
        ],
        "organization": "cirosec GmbH and Ruhr University of Bochum",
        "summary": "coordinating disclosure of CVE-2019-6571"
      },
      {
        "names": [
          "Christian Siemers",
          "Irakli Edjibia"
        ],
        "organization": "Hochschule Augsburg",
        "summary": "coordinating disclosure of CVE-2019-6584"
      },
      {
        "names": [
          "Artem Zinenko"
        ],
        "organization": "Kaspersky",
        "summary": "for pointing out that SIPLUS should also be mentioned"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from a Siemens ProductCERT\u0027s advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-774850: Vulnerabilities in SIEMENS LOGO!8 devices - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-774850.html"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-162-03 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-162-03.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-162-03 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-162-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens LOGO!8 Devices",
    "tracking": {
      "current_release_date": "2020-02-10T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-19-162-03",
      "initial_release_date": "2019-06-11T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2019-06-11T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2020-02-10T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "SIPLUS devices now explicitly mentioned in the list of affected products"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=6ED1052-xyyxx-0BA8_FS:01|\u003c6ED1052-xyyxx-0BA8_FS:06|V1.80.xx|V1.81.xx",
                "product": {
                  "name": "Siemens SIEMENS LOGO!8 (incl. SIPLUS variants): 6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SIEMENS LOGO!8 (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6ED1052-xyyxx-0BA0_FS:01_firmware_V1.82.02",
                "product": {
                  "name": "Siemens SIEMENS LOGO!8 (incl. SIPLUS variants): 6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SIEMENS LOGO!8 (incl. SIPLUS variants)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-6571",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An attacker with network access to port 10005/tcp of the LOGO! device could cause a Denial-of-Service condition by sending specially crafted packets. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Protect network access to the device.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure Siemens strongly recommends to protect network access to the devices with appropriate mechanisms. It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.82.02 or higher https://support.industry.siemens.com/cs/ww/en/view/109767410",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2019-6571"
    },
    {
      "cve": "CVE-2019-6584",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An attacker with network access to port 10005/tcp of the LOGO! device could cause a Denial-of-Service condition by sending specially crafted packets. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected service. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises availability of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Protect network access to the device.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "As a general security measure Siemens strongly recommends to protect network access to the devices with appropriate mechanisms. It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.82.02 or higher https://support.industry.siemens.com/cs/ww/en/view/109767410",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2019-6584"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-6584"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-12T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version \u003c V1.82.02). The integrated webserver does not invalidate the Session ID upon user logout. An attacker that successfully extracted a valid Session ID is able to use it even after the user logs out. The security vulnerability could be exploited by an attacker in a privileged network position who is able to read the communication between the affected device and the user or by an attacker who is able to obtain valid Session IDs through other means. The user must invoke a session to the affected device. At the time of advisory publication no public exploitation of this security vulnerability was known.",
  "id": "GHSA-ggxx-jp5j-2gq2",
  "modified": "2022-05-24T16:47:57Z",
  "published": "2022-05-24T16:47:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6584"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-774850.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}