SB2020041516 - Business Logic Errors in Siemens SIMOTICS, Desigo, APOGEE, and TALON
Published: April 15, 2020
Security Bulletin ID
SB2020041516
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Business Logic Errors (CVE-ID: CVE-2019-13939)
The vulnerability allows a remote attacker to change the IP address of the device to an invalid value.
The vulnerability exists due to logical errors. A remote attacker on the local network can make device configuration changes and affect its availability.
This vulnerability affects the following products and versions:- APOGEE MEC/MBC/PXC (P2): All versions prior to 2.8.2
- APOGEE PXC Series (BACnet): All versions, 3.0 and newer
- APOGEE PCX Series (P2): All versions, 2.8.2 and newer
- Desigo PXC (Power PC): All versions, 2.3x and newer
- Desigo PXM20 (Power PC): All versions, 2.3x and newer
- SIMOTICS CONNECT 400: All versions prior to 0.3.0.330
- TALON TC Series (BACnet): All versions, 3.0 and newer
Remediation
Install update from vendor's website.