Read the docs
TI-2020-15473 Aliases CVE-2020-25236GHSA-xv3q-r363-84pg

Improper handling of exceptional conditions in Siemens LOGO! 12/24RCE

Priority LOW 24CWE-755Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). The control logic (CL) the LOGO! 8 executes could be manipulated in a way that could cause the device executing the CL to improperly handle the manipulation and crash. After successful execution of the attack, the device needs to be manually reset.

Why it matters now

EPSS 0.00265 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensLOGO! 12/24RCEall versions—No fix listedCNA
SiemensLOGO! 12/24RCEoall versions—No fix listedCNA
SiemensLOGO! 230RCEall versions—No fix listedCNA
SiemensLOGO! 230RCEoall versions—No fix listedCNA
SiemensLOGO! 24CEall versions—No fix listedCNA
SiemensLOGO! 24CEoall versions—No fix listedCNA
SiemensLOGO! 24RCEall versions—No fix listedCNA
SiemensLOGO! 24RCEoall versions—No fix listedCNA
SiemensSIPLUS LOGO! 12/24RCEall versions—No fix listedCNA
SiemensSIPLUS LOGO! 12/24RCEoall versions—No fix listedCNA
SiemensSIPLUS LOGO! 230RCEall versions—No fix listedCNA
SiemensSIPLUS LOGO! 230RCEoall versions—No fix listedCNA
SiemensSIPLUS LOGO! 24CEall versions—No fix listedCNA
SiemensSIPLUS LOGO! 24CEoall versions—No fix listedCNA
SiemensSIPLUS LOGO! 24RCEall versions—No fix listedCNA
SiemensSIPLUS LOGO! 24RCEoall versions—No fix listedCNA
  • LOGO! 12/24RCE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 12/24RCEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 230RCE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 230RCEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 24CE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 24CEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 24RCE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • LOGO! 24RCEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 12/24RCE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 12/24RCEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 230RCE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 230RCEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 24CE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 24CEo VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 24RCE VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIPLUS LOGO! 24RCEo VendorSiemens Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:logo\!_8_bm:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:logo\!_8_bm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25236
  2. 2026-10-03 Alias added: GHSA-xv3q-r363-84pg

References

Advisory 1

Other 1

  • TI-2020-06115 Buffer overflow in Siemens LOGO! 8 BM CVSS 3.1CRITICAL 9.8
  • TI-2022-16702 Buffer overflow in Siemens LOGO! 12/24RCE CVSS 3.1CRITICAL 9.8
  • TI-2020-15465 Missing authentication in Siemens LOGO! 8 BM CVSS 3.1CRITICAL 9.8
  • TI-2020-06111 Missing authentication in Siemens LOGO! 8 BM CVSS 3.1CRITICAL 9.1
  • TI-2020-15472 Insufficiently protected credentials in Siemens LOGO! 8 BM CVSS 3.1HIGH 7.5
  • TI-2022-16703 Improper input validation in Siemens LOGO! 12/24RCE CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences