|2017-12-19||Other||Siemens||Tobias Gebhardt reported this vulnerability to Siemens.||N/A||CVE-2017-1274 ||N/A||N/A||N/A|
# Siemens LOGO! Soft Comfort
### VULNERABLE VENDOR
### VULNERABLE PRODUCT
LOGO! Soft Comfort
Tobias Gebhardt reported this vulnerability to Siemens.
### AFFECTED PRODUCTS
Siemens reports that the vulnerability affects the following LOGO! Soft Comfort engineering software products:
LOGO! Soft Comfort: All versions prior to V8.2
Successful exploitation of this vulnerability could allow a remote attacker in a privileged network position to manipulate a software package during download.
### VULNERABILITY OVERVIEW
DOWNLOAD OF CODE WITHOUT INTEGRITY CHECK CWE-494
The update center of LOGO! Soft Comfort lacks integrity verification on software packages downloaded via an unprotected communication channel.
This could allow a remote attacker to manipulate the software package while performing a man-in-the-middle (MitM) attack.
CVE-2017-12740 has been assigned to this vulnerability.
A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Critical Infrastructure Sectors: Commercial Facilities, Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Siemens removed the Update Center from LOGO! Soft Comfort V8.2 and provides SHA-256 checksums for all LOGO! Soft Comfort software packages via a secured HTTPS channel. Siemens recommends verifying legitimacy by comparing the SHA-256 checksum of the downloaded software package with the SHA-256 checksum provided for the software package. Software version 8.2 for LOGO! Soft Comfort and SHA-256 checksums for LOGO! Soft Comfort downloads can be obtained via:
As a general security measure, Siemens strongly recommends protecting network access to the devices with appropriate mechanisms. Siemens advises configuring the environment according to Siemens operational guidelines in order to run the devices in a protected IT environment.
For more information on this vulnerability and more detailed mitigation instructions, please see Siemens Security Advisory SSA-888929 at the following location: