CVE-2014-2251

Опубликовано: 16 мар. 2014

Источник: nvd

CVSS2: 8.3

EPSS Низкий

Описание

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.

Комментарий

CWE-331: Insufficient Entropy

Ссылки

http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01
US Government Resource
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
Patch
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01
US Government Resource
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
Patch
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:*:*:*:*:*:*:*:*

Версия до 1.1.2 (включая)

cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.0.1:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.1.0:*:*:*:*:*:*:*

cpe:2.3:o:siemens:simatic_s7-1500_cpu_firmware:1.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00902

Низкий

8.3 High

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-gc2g-5cgv-c5vh

github

больше 3 лет назад