Improper input validation in Siemens LOGO! 12/24RCE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable and could only be recovered by power cycling the device.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | LOGO! 12/24RCE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 12/24RCE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 12/24RCEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 12/24RCEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 230RCE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 230RCE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 230RCEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 230RCEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24CE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24CE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24CEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24CEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24RCE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24RCE | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24RCEo | All versions | — | No fix listed | CNA |
| Siemens | LOGO! 24RCEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 12/24RCE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 12/24RCE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 12/24RCEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 12/24RCEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 230RCE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 230RCE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 230RCEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 230RCEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24CE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24CE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24CEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24CEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24RCE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24RCE | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24RCEo | All versions | — | No fix listed | CNA |
| Siemens | SIPLUS LOGO! 24RCEo | All versions | — | No fix listed | CNA |
- LOGO! 12/24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 12/24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 12/24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 12/24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 230RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 230RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 230RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 230RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24CE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24CE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24CEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24CEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- LOGO! 24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 12/24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 12/24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 12/24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 12/24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 230RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 230RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 230RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 230RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24CE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24CE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24CEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24CEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24RCE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPLUS LOGO! 24RCEo VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:logo\!8_bm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:logo\!8_bm_fs-05_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:logo\!8_bm_fs-05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:logo\!_8_bm_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:logo\!8_bm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:logo\!8_bm_fs-05_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:logo\!8_bm_fs-05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-36362
- 2026-10-03 Alias added: GHSA-mgxw-53vp-m2rh
References
More Siemens Logo!8 Bm Fs-05 Firmware vulnerabilities
- TI-2022-16702 Buffer overflow in Siemens LOGO! 12/24RCE CVSS 3.1CRITICAL 9.8
- TI-2017-09439 Information disclosure in Siemens LOGO! 8 BM CVSS 3.1HIGH 7.5
- TI-2022-16701 Insufficient verification of data authenticity in Siemens LOGO! 8 BM CVSS 3.1HIGH 7.5
- TI-2022-16704 Improper input validation in Siemens LOGO! 12/24RCE CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-36362 · CVE Program
- CVE-2022-36362 · NVD
- FIRST EPSS
- GHSA-mgxw-53vp-m2rh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences