CVE-2019-10919CWE-306

A vulnerability has been identified in LOGO!

published May 14, 2019

CVSS
—
EPSS
3%
Percentile
86.1
In the wild
Unconfirmed
What it is

🚨 An attacker can take full control without even breaking a sweat! By simply accessing port 10005/tcp, they can reconfigure devices and snatch project files from LOGO! 8 BM systems. 🔥 Think of port 10005 as a maintenance hatch on a building that was never locked. Anyone who knows about it can just waltz in, change the layout, or grab sensitive blueprints, putting everything at risk. If exploited, this vulnerability could allow an attacker to not only tamper with your device configurations but also access sensitive project files, jeopardizing the confidentiality, integrity, and availability of your essential systems. Imagine the chaos that could unfold if unauthorized changes are made to your automation setups!

Put simply

Think of port 10005 as a maintenance hatch on a building that was never locked. Anyone who knows about it can just waltz in, change the layout, or grab sensitive blueprints, putting everything at risk. This vulnerability allows an unauthenticated attacker with access to TCP port 10005 to perform unauthorized device reconfigurations and retrieve project files from all versions of LOGO! 8 BM and SIPLUS variants prior to version 8.3.

What to do

If exploited, this vulnerability could allow an attacker to not only tamper with your device configurations but also access sensitive project files, jeopardizing the confidentiality, integrity, and availability of your essential systems. Imagine the chaos that could unfold if unauthorized changes are made to your automation setups! To protect yourself, ensure you upgrade to at least version 8.3 to close this security gap. Additionally, restrict access to port 10005/tcp by implementing firewalls or other network security measures. Always consult your system manual for best practices! You've got this! By taking these steps, you'll bolster your security and keep your systems safe from prying eyes. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02746 · 86.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2019-05-14T19:54Z
EPSS history
Timeline
  • 14 MAY 19:54Z
    A vulnerability has been identified in LOGO!
    cvelistv5