CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

Design/Logic Flaw

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

Design/Logic Flaw

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12734

Siemens LOGO! 8 BM (incl. SIPLUS variants): all versions prior to V1.81.2 are affected by CVE-2017-12734 (Insufficiently Protected Credentials). An attacker with network access to the integrated web server on port 80/tcp can obtain the session ID of an active user session, requiring a logged-in u...

CVE-2017-12735

Siemens LOGO! 8 BM (incl. SIPLUS variants) is affected by CVE-2017-12735. All versions before v8.3 are vulnerable to a Man-in-the-Middle attack that could allow an attacker to decrypt and modify traffic between the LOGO! BM and other devices. The issue is mitigated by updating to firmware v8.3 (n...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

Siemens Fixes Session Hijacking Bug in LOGO!, Warns of Man-in-the-Middle Attacks

Administrators who have Siemens’ LOGO! logic module deployed in automation setups are being urged to update its firmware. The German industrial manufacturing giant pushed out an update for its LOGO! 8 BM devices Wednesday morning to fix a vulnerability CVE-2017-12734 that could let an attacker...

PT-2017-12672

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM incl. SIPLUS variants versions prior to V1.81.2 Description A vulnerability allows an attacker with network access to the integrated web server on port 80/tcp to obtain the session ID of an active user session, but only if a user is...

PT-2017-12673

Name of the Vulnerable Software and Affected Versions LOGO! 8 BM incl. SIPLUS variants versions prior to V8.3 Description A vulnerability has been identified that could allow an attacker to decrypt and modify network traffic by performing a Man-in-the-Middle attack between the LOGO! BM and other...

CVE-2017-12734: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12735: Channel Accessible by Non-Endpoint

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

Siemens LOGO! (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! Vulnerabilities: Insufficiently Protected Credentials, Man-in-the-Middle 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

Synology Photo Station File Upload Vulnerability (CNVD-2017-27721)

Synology Photo Station is an online photo album and blog owned and managed by DSM users. A file upload vulnerability exists in synothemeupload.php in Synology Photo Station, which can be exploited by remote attackers to upload arbitrary files without authentication via the logoupload operation...

CVE-2017-11151

A vulnerability in synothemeupload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logoupload action...

File upload vulnerability in SchoolCMS backend SiteController.class.php

SchoolCMS is a school teaching management system based on PHP+MySQL. A file upload vulnerability exists in the SchoolCMS backend SiteController.class.php, due to the system Upload function not effectively filtering user-submitted data. A remote attacker can arbitrarily write files to gain web...

Qualys new look and new products

As you all know, it's Black Hat 2017 time. This year Qualys seems to be the main newsmaker among Vulnerability Management vendors. Qualys Team renewed logo and website, updated marketing strategy, presented two new products: CloudView and CertView. I decided to take a look. Talking about design, ...