CVE-2014-2250

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.

CVSS v2.0 8.3 HIGH

8.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:C

Exploitability : 8.6 / Impact : 8.5

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02	US Government Resource
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware::::::::
	cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:3.0:::::::*

OR	cpe:2.3:h:siemens:simatic_s7_cpu-1211c:-:::::::*
	cpe:2.3:h:siemens:simatic_s7_cpu_1212c:-:::::::*
	cpe:2.3:h:siemens:simatic_s7_cpu_1214c:-:::::::*
	cpe:2.3:h:siemens:simatic_s7_cpu_1215c:-:::::::*
	cpe:2.3:h:siemens:simatic_s7_cpu_1217c:-:::::::*

History

No history.

Information

Published : 2014-03-24 14:20

Updated : 2024-02-04 18:35

NVD link : CVE-2014-2250

Mitre link : CVE-2014-2250

CVE.ORG link : CVE-2014-2250

JSON object : View

Products Affected

siemens

simatic_s7_cpu_1212c
simatic_s7_cpu-1211c
simatic_s7_cpu_1217c
simatic_s7_cpu_1214c
simatic_s7_cpu_1200_firmware
simatic_s7_cpu_1215c

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2014-2250", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-24T14:20:39.557", "references": [{"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251."}, {"lang": "es", "value": "El generador de n\u00fameros aleatorios en dispositivos de Siemens SIMATIC S7-1200 CPU PLC con firmware anterior a 4.0 no tiene suficiente entrop\u00eda, lo que facilita a atacantes remotos anular mecanismos de protecci\u00f3n criptogr\u00e1fica y secuestrar sesiones a trav\u00e9s de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2251."}], "lastModified": "2020-02-10T15:15:14.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BCF4722-1850-48CD-9BCA-6EBD9EFF8147", "versionEndIncluding": "3.0.2"}, {"criteria": "cpe:2.3:o:siemens:simatic_s7_cpu_1200_firmware:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8C7A9D3-33C0-465B-914D-3D1FF1BE8272"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu-1211c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7F8E0D6-D9DE-4F2A-A0D3-84A9EEB8EAFD"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1212c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6A11F4A-4DA2-4EDC-A51F-69DA422C320F"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1214c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EB6306C-2F6E-49A3-BFAE-BA6962501697"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1215c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DC6AAEF-22EE-449B-83A8-9BE0B84199EE"}, {"criteria": "cpe:2.3:h:siemens:simatic_s7_cpu_1217c:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36F69756-6304-489F-A287-65D0A9E81943"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}