{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Andover Continuum controller (NetController 1 (NC1) = mod\u00e8le CX9900, NetController 2 (NC2) = mod\u00e8le CX9680, ACX2 = mod\u00e8les ACX5720 et ACX5740, s\u00e9ries CX9200, s\u00e9ries CX9400, CX9924, CX9702, s\u00e9ries BCX4040, s\u00e9ries BCX9640) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine SCADA Expert toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Clipsal (EER72600) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Power Manager versions 1.1, 1.2 et 1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV630/650/660/680/6A0/6B0 Altivar Process Drives 2.6IE31 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 CPUs (BMX P34x) micologiciel versions ant\u00e9rieures \u00e0 3.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "AOS 6.8.8 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Energy Expert version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine Expert (pr\u00e9c\u00e9demment SoMachine et SoMachine Motion) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Smart-UPS et Symmetra UPS Network Management Card 1 (NMC1) SmartSlot (mod\u00e8les AP9617 (fin de support Nov 2011), AP9619 (fin de support Sep 2012), AP9618 (fin de support Jan 2017), Audio/Video Network Management Enabled products (S20BLK, G50NETB2, G50NETB-20A2)) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XGCS850C201 OsiSense RFID compact smart antenna toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV6000 Medium Voltage AltivarProcess Drives 1.1IE02 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ZBRCETH Modbus TCP communication module for ZBRN1 Harmony Hub 02.03 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink EL B 1.2.1 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link C et Link HD toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (2G Metered/Switched Rack PDUs with embedded NMC2, AP84XX, AP86XX, AP88XX, AP89XX)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Ethernet Interface pour ComPact, PowerPact, et disjoncteurs MasterPact toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium processors avec Ethernet COPRO int\u00e9gr\u00e9 (TSXP574634, TSXP575634, TSXP576634) versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TM3BC bus coupler module EIP, SL et CANOpen toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Co-processors ref. 140CPU6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink SI D et SI B 002.004.002 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink IP, Acti9 Smartlink EL B et EL D, Acti9 Smartlink SI B et SI D toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Ethernet communication modules ref.140NOE et 140NOC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 3 (NMC3) SmartSlot (mod\u00e8les AP9640/AP9640J, AP9641/AP9641J) AOS 1.3.0.6 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Link 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 32 RTUsAll versions 2.24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Centrale de mesure PowerLogic PM5000 series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV340E Altivar Machine Drives 3.1IE23 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "StruxureWare\u2122 PowerSCADA Expert with Advanced Reporting and Dashboards Module versions 8.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ACE850 Sepam communication interface toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TeSys T LTMR08EBD Motor Controller toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Gateway Connector par Elko (EKO01827) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Metered/Switched Rack PDUs with embedded NMC1, AP78XX, AP79XX) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link / Link HD 001.008.007 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Momentum Ethernet MDI",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "E+PLC400, E+PLC100 et E+PLC_Setup toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "VW3A3720, VW3A3721 Altivar ProcessCommunication Modules 1.15IE18 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Building SmartX IP MP et IP RP Controllers toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 Communication Ethernet modules BMX NOE 0100 (H) versions ant\u00e9rieures \u00e0 3.3, BMX NOE 0110 (H) versions ant\u00e9rieures \u00e0 6.5, BMX NOC 0401 versions ant\u00e9rieures \u00e0 2.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power Monitoring Expert versions 7.x, 8.x et 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "eIFE Ethernet Interface pour disjoncteurs MasterPact MTZ drawout toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M241 et M251 Logic Controller micrologiciel versions ant\u00e9rieures \u00e0 5.0.8.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EGX150/Link150 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum processors avec Ethernet COPRO int\u00e9gr\u00e9 140CPU65xxxxx versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XUPH001 OsSense communication module toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV930/950/960/980/9A0/9B0 Altivar Process Drives 3.1IE24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PowerLogic EGX300 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum communication modules 140NOE771x1 versions ant\u00e9rieures \u00e0 7.1, 140NOC78x00 versions ant\u00e9rieures \u00e0 1.74, 140NOC77101 versions ant\u00e9rieures \u00e0 1.08",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Ethernet communication modules ref. TSXETY",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Battery Management System, AP9921X, Rack Automatic Transfer Switches, AP77XX, AP9320, AP9340, AP9361, NetBotz NBRK0200, NetworkAir, InRow) AOS 3.9.2 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Schneider Electric (EER31800) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Co-processors ref. TSXP et TSXH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (Battery Manager, AP9922, Rack Automatic Transfer Switches, AP44XX, NetBotz NBRK0250) AOS 6.8.8 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium communication modules TSXETY4103 versions ant\u00e9rieures \u00e0 6.2, TSXETY5103 versions ant\u00e9rieures \u00e0 6.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 Ethernet communication Modules ref. BMXNOC, BMXNOE, BMXNOR",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 CPU ref. BMXP34",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-7547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7547"
    },
    {
      "name": "CVE-2020-14515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
    },
    {
      "name": "CVE-2020-14513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
    },
    {
      "name": "CVE-2020-7548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7548"
    },
    {
      "name": "CVE-2020-7545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7545"
    },
    {
      "name": "CVE-2017-6028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
    },
    {
      "name": "CVE-2020-14517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
    },
    {
      "name": "CVE-2020-14519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
    },
    {
      "name": "CVE-2020-7546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7546"
    },
    {
      "name": "CVE-2020-14509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
    },
    {
      "name": "CVE-2020-16233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
    },
    {
      "name": "CVE-2020-7533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7533"
    },
    {
      "name": "CVE-2020-11898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
    },
    {
      "name": "CVE-2020-11896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-643",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service, un\ncontournement de la politique de s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-02 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-02/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-075-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2017-075-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-04 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-01/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-175-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-175-01/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Andover Continuum controller (NetController 1 (NC1) = mod\u00e8le CX9900, NetController 2 (NC2) = mod\u00e8le CX9680, ACX2 = mod\u00e8les ACX5720 et ACX5740, s\u00e9ries CX9200, s\u00e9ries CX9400, CX9924, CX9702, s\u00e9ries BCX4040, s\u00e9ries BCX9640) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine SCADA Expert toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Clipsal (EER72600) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Power Manager versions 1.1, 1.2 et 1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV630/650/660/680/6A0/6B0 Altivar Process Drives 2.6IE31 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 CPUs (BMX P34x) micologiciel versions ant\u00e9rieures \u00e0 3.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "AOS 6.8.8 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Energy Expert version 2.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Machine Expert (pr\u00e9c\u00e9demment SoMachine et SoMachine Motion) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Smart-UPS et Symmetra UPS Network Management Card 1 (NMC1) SmartSlot (mod\u00e8les AP9617 (fin de support Nov 2011), AP9619 (fin de support Sep 2012), AP9618 (fin de support Jan 2017), Audio/Video Network Management Enabled products (S20BLK, G50NETB2, G50NETB-20A2)) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XGCS850C201 OsiSense RFID compact smart antenna toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV6000 Medium Voltage AltivarProcess Drives 1.1IE02 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ZBRCETH Modbus TCP communication module for ZBRN1 Harmony Hub 02.03 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink EL B 1.2.1 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link C et Link HD toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (2G Metered/Switched Rack PDUs with embedded NMC2, AP84XX, AP86XX, AP88XX, AP89XX)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IFE Ethernet Interface pour ComPact, PowerPact, et disjoncteurs MasterPact toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium processors avec Ethernet COPRO int\u00e9gr\u00e9 (TSXP574634, TSXP575634, TSXP576634) versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TM3BC bus coupler module EIP, SL et CANOpen toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Co-processors ref. 140CPU6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink SI D et SI B 002.004.002 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 Smartlink IP, Acti9 Smartlink EL B et EL D, Acti9 Smartlink SI B et SI D toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Quantum Ethernet communication modules ref.140NOE et 140NOC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 3 (NMC3) SmartSlot (mod\u00e8les AP9640/AP9640J, AP9641/AP9641J) AOS 1.3.0.6 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Link 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack 32 RTUsAll versions 2.24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Centrale de mesure PowerLogic PM5000 series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV340E Altivar Machine Drives 3.1IE23 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "StruxureWare\u2122 PowerSCADA Expert with Advanced Reporting and Dashboards Module versions 8.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ACE850 Sepam communication interface toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TeSys T LTMR08EBD Motor Controller toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy 1.5.0 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Gateway Connector par Elko (EKO01827) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Metered/Switched Rack PDUs with embedded NMC1, AP78XX, AP79XX) AOS 3.9.2 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Acti9 PowerTag Link / Link HD 001.008.007 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Momentum Ethernet MDI",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "E+PLC400, E+PLC100 et E+PLC_Setup toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "VW3A3720, VW3A3721 Altivar ProcessCommunication Modules 1.15IE18 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Building SmartX IP MP et IP RP Controllers toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "M340 Communication Ethernet modules BMX NOE 0100 (H) versions ant\u00e9rieures \u00e0 3.3, BMX NOE 0110 (H) versions ant\u00e9rieures \u00e0 6.5, BMX NOC 0401 versions ant\u00e9rieures \u00e0 2.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122Power Monitoring Expert versions 7.x, 8.x et 9.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "eIFE Ethernet Interface pour disjoncteurs MasterPact MTZ drawout toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M241 et M251 Logic Controller micrologiciel versions ant\u00e9rieures \u00e0 5.0.8.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EGX150/Link150 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum processors avec Ethernet COPRO int\u00e9gr\u00e9 140CPU65xxxxx versions ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "XUPH001 OsSense communication module toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "ATV930/950/960/980/9A0/9B0 Altivar Process Drives 3.1IE24 et versions ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PowerLogic EGX300 Ethernet Gateway toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Quantum communication modules 140NOE771x1 versions ant\u00e9rieures \u00e0 7.1, 140NOC78x00 versions ant\u00e9rieures \u00e0 1.74, 140NOC77101 versions ant\u00e9rieures \u00e0 1.08",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Ethernet communication modules ref. TSXETY",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC1 (Battery Management System, AP9921X, Rack Automatic Transfer Switches, AP77XX, AP9320, AP9340, AP9361, NetBotz NBRK0200, NetworkAir, InRow) AOS 3.9.2 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Wiser Energy IP module par Schneider Electric (EER31800) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium Co-processors ref. TSXP et TSXH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Embedded NMC2 (Battery Manager, AP9922, Rack Automatic Transfer Switches, AP44XX, NetBotz NBRK0250) AOS 6.8.8 et version ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Premium communication modules TSXETY4103 versions ant\u00e9rieures \u00e0 6.2, TSXETY5103 versions ant\u00e9rieures \u00e0 6.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 Ethernet communication Modules ref. BMXNOC, BMXNOE, BMXNOR",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 CPU ref. BMXP34",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-7547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7547"
    },
    {
      "name": "CVE-2020-14515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
    },
    {
      "name": "CVE-2020-14513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
    },
    {
      "name": "CVE-2020-7548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7548"
    },
    {
      "name": "CVE-2020-7545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7545"
    },
    {
      "name": "CVE-2017-6028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
    },
    {
      "name": "CVE-2020-14517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
    },
    {
      "name": "CVE-2020-14519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
    },
    {
      "name": "CVE-2020-7546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7546"
    },
    {
      "name": "CVE-2020-14509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
    },
    {
      "name": "CVE-2020-16233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
    },
    {
      "name": "CVE-2020-7533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7533"
    },
    {
      "name": "CVE-2020-11898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
    },
    {
      "name": "CVE-2020-11896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-643",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service, un\ncontournement de la politique de s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-02 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-02/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-075-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2017-075-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-03 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-03/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-04 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-287-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-01/"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2020-175-01 du 10 octobre 2020",
      "url": "https://www.se.com/ww/en/download/document/SEVD-2020-175-01/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPPA-S2000 (S7)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI United Comfort Panels",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Polarion Subversion Webclient",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance Video Client toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Process Historian",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC, SIMOTION et SINUMERIK (voir le site du constructeur pour les versions vuln\u00e9rables, cf. section Documentation)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC OA",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Basic Panels 2nd Generation versions ant\u00e9rieures \u00e0 14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SPPA-T3000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SPPA-S3000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-300 CPU family",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "License Management Utility (LMU) versions ant\u00e9rieures \u00e0 2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RTLS Locating Manager versions ant\u00e9rieures \u00e0 V2.10.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC PCS neo",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Spectrum Power 4 versions ant\u00e9rieures \u00e0 4.70 SP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Information Server",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Comfort Panels",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEC INS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Mobile Panels",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMIT Simulation Platform",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-400 CPU family",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-15788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15788"
    },
    {
      "name": "CVE-2020-14515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
    },
    {
      "name": "CVE-2020-14513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
    },
    {
      "name": "CVE-2020-10050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10050"
    },
    {
      "name": "CVE-2020-10056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10056"
    },
    {
      "name": "CVE-2020-15791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15791"
    },
    {
      "name": "CVE-2020-15786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15786"
    },
    {
      "name": "CVE-2020-15785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15785"
    },
    {
      "name": "CVE-2020-14517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
    },
    {
      "name": "CVE-2020-14519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
    },
    {
      "name": "CVE-2020-15790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15790"
    },
    {
      "name": "CVE-2020-15789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15789"
    },
    {
      "name": "CVE-2020-10049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10049"
    },
    {
      "name": "CVE-2020-15787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15787"
    },
    {
      "name": "CVE-2020-14509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
    },
    {
      "name": "CVE-2020-10051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10051"
    },
    {
      "name": "CVE-2020-15784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15784"
    },
    {
      "name": "CVE-2020-16233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
    },
    {
      "name": "CVE-2020-0543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0543"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-550",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-08T00:00:00.000000"
    },
    {
      "description": "Ajout du lien vers les produits Siemens Energy (https://cert-portal.siemens.com/productcert/html/ssa-455844.html)",
      "revision_date": "2022-02-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-568969 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455844 du 17 f\u00e9vrier 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-455844.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455843 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-251935 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-436520 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-381684 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-770698 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-709003 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-542525 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-534763 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-534763.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SPPA-S2000 (S7)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI United Comfort Panels",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Polarion Subversion Webclient",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance Video Client toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Process Historian",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC, SIMOTION et SINUMERIK (voir le site du constructeur pour les versions vuln\u00e9rables, cf. section Documentation)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC OA",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Basic Panels 2nd Generation versions ant\u00e9rieures \u00e0 14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SPPA-T3000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SPPA-S3000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-300 CPU family",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "License Management Utility (LMU) versions ant\u00e9rieures \u00e0 2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RTLS Locating Manager versions ant\u00e9rieures \u00e0 V2.10.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC PCS neo",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Spectrum Power 4 versions ant\u00e9rieures \u00e0 4.70 SP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Information Server",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Comfort Panels",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEC INS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Mobile Panels",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMIT Simulation Platform",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-400 CPU family",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-15788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15788"
    },
    {
      "name": "CVE-2020-14515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
    },
    {
      "name": "CVE-2020-14513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
    },
    {
      "name": "CVE-2020-10050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10050"
    },
    {
      "name": "CVE-2020-10056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10056"
    },
    {
      "name": "CVE-2020-15791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15791"
    },
    {
      "name": "CVE-2020-15786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15786"
    },
    {
      "name": "CVE-2020-15785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15785"
    },
    {
      "name": "CVE-2020-14517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
    },
    {
      "name": "CVE-2020-14519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
    },
    {
      "name": "CVE-2020-15790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15790"
    },
    {
      "name": "CVE-2020-15789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15789"
    },
    {
      "name": "CVE-2020-10049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10049"
    },
    {
      "name": "CVE-2020-15787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15787"
    },
    {
      "name": "CVE-2020-14509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
    },
    {
      "name": "CVE-2020-10051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10051"
    },
    {
      "name": "CVE-2020-15784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15784"
    },
    {
      "name": "CVE-2020-16233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
    },
    {
      "name": "CVE-2020-0543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0543"
    }
  ],
  "links": [],
  "reference": "CERTFR-2020-AVI-550",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-08T00:00:00.000000"
    },
    {
      "description": "Ajout du lien vers les produits Siemens Energy (https://cert-portal.siemens.com/productcert/html/ssa-455844.html)",
      "revision_date": "2022-02-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-568969 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455844 du 17 f\u00e9vrier 2022",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-455844.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-455843 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-251935 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-436520 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-381684 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-770698 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-709003 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-542525 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-534763 du 08 septembre 2020",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-534763.pdf"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Cybersecurity and Infrastructure Security Agency (CISA)",
        "summary": "coordination efforts"
      },
      {
        "organization": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI)",
        "summary": "coordination efforts"
      },
      {
        "organization": "WIBU Systems CERT",
        "summary": "coordination efforts"
      }
    ],
    "category": "Siemens Security Advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management.\n\nThe vulnerabilities are described in the section \"Vulnerability Classification\" below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and CVE-2020-16233. Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, attain remote code execution, or prevent normal operation of the Siemens software that depends on CodeMeter Runtime.\n\nSiemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-455843.txt"
      },
      {
        "category": "self",
        "summary": "SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-455843.json"
      }
    ],
    "title": "SSA-455843: WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products",
    "tracking": {
      "current_release_date": "2022-02-17T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-455843",
      "initial_release_date": "2020-09-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2020-09-08T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2020-10-13T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added PSS CAPE Protection Simulation Platform; added solution by software update for SIMATIC WinCC OA; added solution by installation of latest CodeMeter Runtime version for SIMIT, SINEC INS, and PSS CAPE"
        },
        {
          "date": "2020-11-10T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added SICAM 230"
        },
        {
          "date": "2021-01-12T00:00:00Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Updated solutions for PCS neo and SPPA T3000 (with fixes for the open CVEs)"
        },
        {
          "date": "2021-02-09T00:00:00Z",
          "legacy_version": "1.4",
          "number": "5",
          "summary": "Updated solution for SPPA S3000 (with fixes for the open CVEs)"
        },
        {
          "date": "2021-03-09T00:00:00Z",
          "legacy_version": "1.5",
          "number": "6",
          "summary": "Updated solution for SINEC INS and SINEMA Remote Connect"
        },
        {
          "date": "2021-04-13T00:00:00Z",
          "legacy_version": "1.6",
          "number": "7",
          "summary": "Updated solution for PSS CAPE and SIMIT"
        },
        {
          "date": "2022-02-17T00:00:00Z",
          "legacy_version": "1.7",
          "number": "8",
          "summary": "Moved products from Siemens Energy to separate advisory SSA-455844"
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "CAPE 14 installations installed from material dated earlier than 2020-09-15",
                "product": {
                  "name": "PSS CAPE Protection Simulation Platform",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "PSS CAPE Protection Simulation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SICAM 230",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "SICAM 230"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Version 2019 SP1",
                "product": {
                  "name": "SIMATIC Information Server 2019",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Information Server 2019"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.0 SP1 Update 1",
                "product": {
                  "name": "SIMATIC PCS neo",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC PCS neo"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c SP1 Update 1",
                "product": {
                  "name": "SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.17 P007",
                "product": {
                  "name": "SIMATIC WinCC OA",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC OA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e= V10.0 and \u003c V10.2 Upd1",
                "product": {
                  "name": "SIMIT Simulation Platform",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMIT Simulation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V1.0 SP1",
                "product": {
                  "name": "SINEC INS",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC INS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.0",
                "product": {
                  "name": "SINEMA Remote Connect",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEMA Remote Connect"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-14509",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Multiple memory corruption vulnerabilities exist where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-14509 - SIMATIC Information Server 2019",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14509 - SIMATIC PCS neo",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14509 - SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14509 - SIMATIC WinCC OA",
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "summary": "CVE-2020-14509 - SIMIT Simulation Platform",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "summary": "CVE-2020-14509 - SINEC INS",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "summary": "CVE-2020-14509 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14509.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "mitigation",
          "details": "See also the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no remediation is planned",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "3"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 SP1 Update 1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.17 P007 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.2 Upd1 or later version",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "category": "mitigation",
          "details": "For earlier versions see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "7",
            "8"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP1 or later version",
          "product_ids": [
            "8"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "category": "mitigation",
          "details": "All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMATIC WinCC OA V3.17:\n\nUpdate to V3.17 P007 or later version to fix all issues. For patch levels \u003c P007, the following measures apply:\n\nCVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517.\n\nCVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMIT Simulation Platform (Versions \u003e= V10.0 and \u003c V10.2 Upd1):\n\nTo fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SINEC INS (Versions \u003c V1.0 SP1 only):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package \"CodeMeter User Runtime for Linux, version 7.10a, Driver-only\" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command:\n\nsudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual.\n\nContact PSS\u00aeCAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SICAM 230\n\nTo fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        }
      ],
      "title": "CVE-2020-14509"
    },
    {
      "cve": "CVE-2020-14513",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "CodeMeter and the software using it may crash while processing a specifically crafted license file due to unverified length fields.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "4",
          "5",
          "7",
          "9"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-14513 - SIMATIC PCS neo",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14513 - SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14513 - SIMIT Simulation Platform",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "summary": "CVE-2020-14513 - SINEMA Remote Connect",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793790/"
        },
        {
          "summary": "CVE-2020-14513 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14513.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "mitigation",
          "details": "See also the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no remediation is planned",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 SP1 Update 1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.2 Upd1 or later version",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "category": "mitigation",
          "details": "For earlier versions see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "7",
            "9"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version",
          "product_ids": [
            "9"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793790/"
        },
        {
          "category": "mitigation",
          "details": "All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMATIC WinCC OA V3.17:\n\nUpdate to V3.17 P007 or later version to fix all issues. For patch levels \u003c P007, the following measures apply:\n\nCVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517.\n\nCVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMIT Simulation Platform (Versions \u003e= V10.0 and \u003c V10.2 Upd1):\n\nTo fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SINEC INS (Versions \u003c V1.0 SP1 only):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package \"CodeMeter User Runtime for Linux, version 7.10a, Driver-only\" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command:\n\nsudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual.\n\nContact PSS\u00aeCAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SICAM 230\n\nTo fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        }
      ],
      "title": "CVE-2020-14513"
    },
    {
      "cve": "CVE-2020-14515",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is an issue in the license-file signature checking mechanism, which could allow attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "4",
          "5",
          "7",
          "9"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-14515 - SIMATIC PCS neo",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14515 - SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14515 - SIMIT Simulation Platform",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "summary": "CVE-2020-14515 - SINEMA Remote Connect",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793790/"
        },
        {
          "summary": "CVE-2020-14515 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14515.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "mitigation",
          "details": "See also the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no remediation is planned",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 SP1 Update 1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.2 Upd1 or later version",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "category": "mitigation",
          "details": "For earlier versions see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "7",
            "9"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version",
          "product_ids": [
            "9"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793790/"
        },
        {
          "category": "mitigation",
          "details": "All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMATIC WinCC OA V3.17:\n\nUpdate to V3.17 P007 or later version to fix all issues. For patch levels \u003c P007, the following measures apply:\n\nCVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517.\n\nCVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMIT Simulation Platform (Versions \u003e= V10.0 and \u003c V10.2 Upd1):\n\nTo fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SINEC INS (Versions \u003c V1.0 SP1 only):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package \"CodeMeter User Runtime for Linux, version 7.10a, Driver-only\" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command:\n\nsudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual.\n\nContact PSS\u00aeCAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SICAM 230\n\nTo fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.",
          "product_ids": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "4",
            "5",
            "7",
            "9"
          ]
        }
      ],
      "title": "CVE-2020-14515"
    },
    {
      "cve": "CVE-2020-14517",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Protocol encryption can be easily broken and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-14517 - SIMATIC Information Server 2019",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14517 - SIMATIC PCS neo",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14517 - SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14517 - SIMATIC WinCC OA",
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "summary": "CVE-2020-14517 - SIMIT Simulation Platform",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "summary": "CVE-2020-14517 - SINEC INS",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "summary": "CVE-2020-14517 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14517.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "mitigation",
          "details": "See also the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no remediation is planned",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "3"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 SP1 Update 1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.17 P007 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.2 Upd1 or later version",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "category": "mitigation",
          "details": "For earlier versions see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "7",
            "8"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP1 or later version",
          "product_ids": [
            "8"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "category": "mitigation",
          "details": "All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMATIC WinCC OA V3.17:\n\nUpdate to V3.17 P007 or later version to fix all issues. For patch levels \u003c P007, the following measures apply:\n\nCVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517.\n\nCVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMIT Simulation Platform (Versions \u003e= V10.0 and \u003c V10.2 Upd1):\n\nTo fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SINEC INS (Versions \u003c V1.0 SP1 only):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package \"CodeMeter User Runtime for Linux, version 7.10a, Driver-only\" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command:\n\nsudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual.\n\nContact PSS\u00aeCAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SICAM 230\n\nTo fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        }
      ],
      "title": "CVE-2020-14517"
    },
    {
      "cve": "CVE-2020-14519",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This vulnerability could allow an attacker to use an internal API via a specifically crafted Java Script payload, which may allow alteration or creation of license files.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-14519 - SIMATIC Information Server 2019",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14519 - SIMATIC PCS neo",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14519 - SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-14519 - SIMATIC WinCC OA",
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "summary": "CVE-2020-14519 - SIMIT Simulation Platform",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "summary": "CVE-2020-14519 - SINEC INS",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "summary": "CVE-2020-14519 - SINEMA Remote Connect",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793790/"
        },
        {
          "summary": "CVE-2020-14519 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-14519.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "mitigation",
          "details": "See also the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no remediation is planned",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "3"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 SP1 Update 1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.17 P007 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.2 Upd1 or later version",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "category": "mitigation",
          "details": "For earlier versions see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP1 or later version",
          "product_ids": [
            "8"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version",
          "product_ids": [
            "9"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793790/"
        },
        {
          "category": "mitigation",
          "details": "All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMATIC WinCC OA V3.17:\n\nUpdate to V3.17 P007 or later version to fix all issues. For patch levels \u003c P007, the following measures apply:\n\nCVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517.\n\nCVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMIT Simulation Platform (Versions \u003e= V10.0 and \u003c V10.2 Upd1):\n\nTo fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SINEC INS (Versions \u003c V1.0 SP1 only):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package \"CodeMeter User Runtime for Linux, version 7.10a, Driver-only\" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command:\n\nsudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual.\n\nContact PSS\u00aeCAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "SICAM 230\n\nTo fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2020-14519"
    },
    {
      "cve": "CVE-2020-16233",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An attacker could send a specially crafted packet that could have the server send back packets containing data from the heap.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-16233 - SIMATIC Information Server 2019",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-16233 - SIMATIC PCS neo",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-16233 - SIMATIC Process Historian 2019 (incl. Process Historian OPC UA Server)",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "summary": "CVE-2020-16233 - SIMATIC WinCC OA",
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "summary": "CVE-2020-16233 - SIMIT Simulation Platform",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "summary": "CVE-2020-16233 - SINEC INS",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "summary": "CVE-2020-16233 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-16233.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "CAPE 14 installations installed from material dated 2020-09-15 or later are not affected, as they contain a fixed version of CodeMeter Runtime",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "If CAPE 14 was initially installed using earlier material, see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to SICAM 230 V8.00 or later version. Install WIBU Systems CodeMeter Runtime V7.10a to fix all issues",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "mitigation",
          "details": "See also the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no remediation is planned",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to Information Server 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "3"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 SP1 Update 1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to Process Historian 2019 SP1 Update 1 contained in PCS neo V3.0 SP1 Update 1",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109784449/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.17 P007 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://www.winccoa.com/downloads/category/versions-patches.html"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.2 Upd1 or later version",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109794248/"
        },
        {
          "category": "mitigation",
          "details": "For earlier versions see the recommendations from section Workarounds and Mitigations",
          "product_ids": [
            "7",
            "8"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP1 or later version",
          "product_ids": [
            "8"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109793469/"
        },
        {
          "category": "mitigation",
          "details": "All products affected by CVE-2020-14513 or CVE-2020-14515: Do not import license files from untrusted sources.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMATIC WinCC OA V3.17:\n\nUpdate to V3.17 P007 or later version to fix all issues. For patch levels \u003c P007, the following measures apply:\n\nCVE-2020-14509, CVE-2020-14517, and CVE-2020-16233 are already mitigated by default, as no external connections to port 22350/tcp are allowed. Additionally, an update to SIMATIC WinCC OA version V3.17 P006 partially fixes CVE-2020-14517.\n\nCVE-2020-14519: Disable the WebSockets API of CodeMeter Runtime.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SIMIT Simulation Platform (Versions \u003e= V10.0 and \u003c V10.2 Upd1):\n\nTo fix all issues for existing installations, update CodeMeter Runtime to V7.10a: Download from the WIBU Systems User Software website and install on the SIMIT system.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SINEC INS (Versions \u003c V1.0 SP1 only):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package \"CodeMeter User Runtime for Linux, version 7.10a, Driver-only\" from the WIBU Systems User Software website. Install it on the system which runs SINEC INS by executing the following command:\n\nsudo dpkg --force-depends --force-confnew -i codemeter-lite_7.10.4196.501_amd64.deb",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "PSS CAPE Protection Simulation Platform (if initally installed from material dated earlier than 2020-09-15):\n\nUpdate CodeMeter Runtime to V7.10a: Download the package from https://www.psscape.com/codemeter and install it the same way as previous versions documented in the PSS CAPE 14 Installation Manual.\n\nContact PSS\u00aeCAPE Support at psscape.support.energy@siemens.com if you need assistance with patching affected systems.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "SICAM 230\n\nTo fix all issues for existing installations, update SICAM 230 to V8.00 or later version. Then update CodeMeter Runtime to V7.10a: Download the package from WIBU Systems User Software website. Install it on SICAM 230 systems according to the procedure documented in chapter 9 of COPA-DATA Security Vulnerability Announcement 2020_1.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:T/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8"
          ]
        }
      ],
      "title": "CVE-2020-16233"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202009-0304",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "codemeter",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "wibu",
        "version": "7.00"
      },
      {
        "model": "codemeter",
        "scope": null,
        "trust": 0.8,
        "vendor": "wibu",
        "version": null
      },
      {
        "model": "codemeter",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "wibu",
        "version": "7.00"
      },
      {
        "model": "codemeter",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "wibu",
        "version": null
      },
      {
        "model": "sinec ins",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "sinema remote connect",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:wibu:codemeter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.00",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      }
    ]
  },
  "cve": "CVE-2020-14519",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2020-14519",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.4,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2020-51241",
            "impactScore": 9.2,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2020-14519",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-14519",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-51241",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202009-486",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515. CodeMeter Exists in a vulnerability related to same-origin policy violations.Information may be tampered with. Siemens SIMATIC WinCC OA (Open Architecture) is a set of SCADA system of Siemens (Siemens), Germany, and it is also an integral part of HMI series. The system is mainly suitable for industries such as rail transit, building automation and public power supply. Information Server is used to report and visualize the process data stored in the Process Historian. SINEC INS is a web-based application that combines various network services in one tool. \n\r\n\r\nMany Siemens products have security vulnerabilities. Attackers can use vulnerabilities to change or create license files",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-14519",
        "trust": 3.8
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-20-203-01",
        "trust": 2.4
      },
      {
        "db": "JVN",
        "id": "JVNVU90770748",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU94568336",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223",
        "trust": 0.8
      },
      {
        "db": "SIEMENS",
        "id": "SSA-455843",
        "trust": 0.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3076.2",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3076.3",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3076",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022021806",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "id": "VAR-202009-0304",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      }
    ],
    "trust": 1.06346013
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      }
    ]
  },
  "last_update_date": "2023-12-18T10:56:21.427000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CodeMeter",
        "trust": 0.8,
        "url": "https://www.wibu.com/products/codemeter.html"
      },
      {
        "title": "Patch for Multiple Siemens products verification error vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/233347"
      },
      {
        "title": "Wibu-Systems AG CodeMeter Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=127907"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-346",
        "trust": 1.0
      },
      {
        "problemtype": "Same-origin policy violation (CWE-346) [ Other ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14519"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu94568336/"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu90770748/"
      },
      {
        "trust": 0.6,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/siemens-simatic-six-vulnerabilities-via-wibu-systems-codemeter-runtime-33282"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022021806"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3076.2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3076.3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3076/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-09-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "date": "2021-03-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "date": "2020-09-16T20:15:13.723000",
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "date": "2020-09-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-09-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-51241"
      },
      {
        "date": "2022-03-15T05:12:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      },
      {
        "date": "2020-09-22T18:07:41.903000",
        "db": "NVD",
        "id": "CVE-2020-14519"
      },
      {
        "date": "2022-02-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "CodeMeter\u00a0 Vulnerability regarding same-origin policy violation in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011223"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "access control error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-486"
      }
    ],
    "trust": 0.6
  }
}

{
  "GSD": {
    "alias": "CVE-2020-14519",
    "description": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.",
    "id": "GSD-2020-14519"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-14519"
      ],
      "details": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.",
      "id": "GSD-2020-14519",
      "modified": "2023-12-13T01:22:00.315666Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "ID": "CVE-2020-14519",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "CodeMeter",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions prior to 7.00, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server."
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "ORIGIN VALIDATION ERROR CWE-346"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01",
            "refsource": "MISC",
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:wibu:codemeter:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.00",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2020-14519"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-346"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2020-09-22T18:07Z",
      "publishedDate": "2020-09-16T20:15Z"
    }
  }
}

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Sharon Brizinov",
          "Tal Keren"
        ],
        "organization": "Claroty",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could allow an attacker to alter and forge a license file, cause a denial-of-service condition, potentially attain remote code execution, read heap data, and prevent normal operation of third-party software dependent on the CodeMeter.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-20-203-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-203-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-20-203-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-203-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Wibu-Systems CodeMeter (Update F)",
    "tracking": {
      "current_release_date": "2022-03-10T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-20-203-01",
      "initial_release_date": "2020-08-20T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2020-08-20T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-20-203-01P WIBU SYSTEMS AG CodeMeter (Update A) "
        },
        {
          "date": "2020-09-08T00:00:00.000000Z",
          "legacy_version": "A",
          "number": "2",
          "summary": "ICSA-20-203-01 Wibu-Systems CodeMeter (Update A)"
        },
        {
          "date": "2020-09-17T00:00:00.000000Z",
          "legacy_version": "B",
          "number": "3",
          "summary": "ICSA-20-203-01 Wibu-Systems AG CodeMeter (Update B)"
        },
        {
          "date": "2020-10-01T00:00:00.000000Z",
          "legacy_version": "C",
          "number": "4",
          "summary": "ICSA-20-203-01 Wibu-Systems CodeMeter (Update C)"
        },
        {
          "date": "2020-10-15T00:00:00.000000Z",
          "legacy_version": "D",
          "number": "5",
          "summary": "ICSA-20-203-01 Wibu-Systems CodeMeter (Update D)"
        },
        {
          "date": "2020-12-03T00:00:00.000000Z",
          "legacy_version": "E",
          "number": "6",
          "summary": "ICSA-20-203-01 Wibu-Systems CodeMeter (Update E)"
        },
        {
          "date": "2021-02-11T00:00:00.000000Z",
          "legacy_version": "F",
          "number": "7",
          "summary": "ICSA-20-203-01 Wibu-Systems CodeMeter (Update F)"
        },
        {
          "date": "2022-03-10T00:00:00.000000Z",
          "legacy_version": "G",
          "number": "8",
          "summary": "ICSA-20-203-01 Wibu-Systems CodeMeter (Update G)"
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 7.10a",
                "product": {
                  "name": "CodeMeter: All versions prior to 7.10a are affected by CVE-2020-14509 and CVE-2020-14519",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "CodeMeter"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.90",
                "product": {
                  "name": "CodeMeter: All versions prior to 6.90 are affected by CVE-2020-14515 when using CmActLicense update files with CmActLicense Firm Code",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "CodeMeter"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 7.10a",
                "product": {
                  "name": "CodeMeter: All versions prior to 7.10a are affected by CVE-2020-14517",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "CodeMeter"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 7.10",
                "product": {
                  "name": "CodeMeter: All versions prior to 7.10 are affected by CVE-2020-16233",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "CodeMeter"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.81",
                "product": {
                  "name": "CodeMeter: All versions prior to 6.81 are affected by CVE-2020-14513",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "CodeMeter"
          }
        ],
        "category": "vendor",
        "name": "Wibu-Systems AG"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-14509",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Multiple memory corruption vulnerabilities exist where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.CVE-2020-14509 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14509"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Wibu-Systems recommends the following:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information please see Wibu-Systems \u0027 security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information on products dependent on the affected CodeMeter see the following vendor security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-14517",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Protocol encryption can be easily broken and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.CVE-2020-14517 has been assigned to this vulnerability. A CVSS v3 base score of 9.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14517"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Wibu-Systems recommends the following:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information please see Wibu-Systems \u0027 security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information on products dependent on the affected CodeMeter see the following vendor security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-14519",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "This vulnerability allows an attacker to use the internal WebSockets API via a specifically crafted Java Script payload, which may allow alteration or creation of license files when combined with CVE-2020-14515.CVE-2020-14519 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14519"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Wibu-Systems recommends the following:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information please see Wibu-Systems \u0027 security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information on products dependent on the affected CodeMeter see the following vendor security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-14513",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "CodeMeter and the software using it may crash while processing a specifically crafted license file due to unverified length fields.CVE-2020-14513 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14513"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Wibu-Systems recommends the following:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information please see Wibu-Systems \u0027 security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information on products dependent on the affected CodeMeter see the following vendor security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-14515",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There is an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.CVE-2020-14515 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14515"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Wibu-Systems recommends the following:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information please see Wibu-Systems \u0027 security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information on products dependent on the affected CodeMeter see the following vendor security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-16233",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An attacker could send a specially crafted packet that could have the server send back packets containing data from the heap.CVE-2020-16233 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16233"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Wibu-Systems recommends the following:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information please see Wibu-Systems \u0027 security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        },
        {
          "category": "vendor_fix",
          "details": "For more information on products dependent on the affected CodeMeter see the following vendor security advisories:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-041"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ]
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wibu:codemeter:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B318D33-8F6C-46AC-80CB-7D519E47531E",
              "versionEndExcluding": "7.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite a un atacante utilizar la API de WebSockets interna para CodeMeter (todas las versiones anteriores a 7.00 est\u00e1n afectadas, incluyendo la versi\u00f3n 7.0 o m\u00e1s reciente con la API de WebSockets afectada a\u00fan habilitada. Esto es especialmente relevante para los sistemas o dispositivos en los que se usa un navegador web para acceder a un servidor web) por medio de una carga \u00fatil de Java Script espec\u00edficamente dise\u00f1ada, que puede permitir una alteraci\u00f3n o creaci\u00f3n de archivos de licencia para cuando se combina con CVE-2020-14515"
    }
  ],
  "id": "CVE-2020-14519",
  "lastModified": "2024-11-21T05:03:26.710",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-16T20:15:13.723",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-14519"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-16T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.",
  "id": "GHSA-qf8w-r56m-c9xh",
  "modified": "2022-05-24T17:28:24Z",
  "published": "2022-05-24T17:28:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14519"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-203-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-14519"
    }
  },
  "description": "Siemens SIMATIC WinCC OA\uff08Open Architecture\uff09\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u5957SCADA\u7cfb\u7edf\uff0c\u4e5f\u662fHMI\u7cfb\u5217\u7684\u4e00\u4e2a\u7ec4\u6210\u90e8\u5206\u3002\u8be5\u7cfb\u7edf\u4e3b\u8981\u9002\u7528\u4e8e\u8f68\u9053\u4ea4\u901a\u3001\u697c\u5b87\u81ea\u52a8\u5316\u548c\u516c\u5171\u7535\u529b\u4f9b\u5e94\u7b49\u884c\u4e1a\u3002Information Server\u7528\u4e8e\u62a5\u544a\u548c\u53ef\u89c6\u5316\u5b58\u50a8\u5728Process Historian\u4e2d\u7684\u8fc7\u7a0b\u6570\u636e\u3002SINEC INS\u662f\u57fa\u4e8eWeb\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u5c06\u5404\u79cd\u7f51\u7edc\u670d\u52a1\u7ec4\u5408\u5728\u4e00\u4e2a\u5de5\u5177\u4e2d\u3002\n\n\u591a\u6b3eSiemens\u4ea7\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u66f4\u6539\u6216\u521b\u5efa\u8bb8\u53ef\u8bc1\u6587\u4ef6\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-51241",
  "openTime": "2020-09-10",
  "patchDescription": "Siemens SIMATIC WinCC OA\uff08Open Architecture\uff09\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u5957SCADA\u7cfb\u7edf\uff0c\u4e5f\u662fHMI\u7cfb\u5217\u7684\u4e00\u4e2a\u7ec4\u6210\u90e8\u5206\u3002\u8be5\u7cfb\u7edf\u4e3b\u8981\u9002\u7528\u4e8e\u8f68\u9053\u4ea4\u901a\u3001\u697c\u5b87\u81ea\u52a8\u5316\u548c\u516c\u5171\u7535\u529b\u4f9b\u5e94\u7b49\u884c\u4e1a\u3002Information Server\u7528\u4e8e\u62a5\u544a\u548c\u53ef\u89c6\u5316\u5b58\u50a8\u5728Process Historian\u4e2d\u7684\u8fc7\u7a0b\u6570\u636e\u3002SINEC INS\u662f\u57fa\u4e8eWeb\u7684\u5e94\u7528\u7a0b\u5e8f\uff0c\u5c06\u5404\u79cd\u7f51\u7edc\u670d\u52a1\u7ec4\u5408\u5728\u4e00\u4e2a\u5de5\u5177\u4e2d\u3002\r\n\r\n\u591a\u6b3eSiemens\u4ea7\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u66f4\u6539\u6216\u521b\u5efa\u8bb8\u53ef\u8bc1\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSiemens\u4ea7\u54c1\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SINEC INS",
      "SIEMENS SINEMA Remote Connect"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2020-09-09",
  "title": "\u591a\u6b3eSiemens\u4ea7\u54c1\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}