CVE-2022-42784 describes an electromagnetic fault injection vulnerability affecting various Siemens LOGO! and SIPLUS LOGO! industrial control devices running firmware version V8.3 and above. An attacker with physical proximity can exploit this to dump and debug firmware, manipulate memory, and inject custom public keys signed by the product CA. This allows for the generation of custom certificates, enabling impersonation of other devices of the same version. With a CVSS score of 6.8 (Medium), the attack requires physical access but grants high impact on confidentiality, integrity, and availability. Currently, there is no public exploit code available, and it is not listed on the CISA KEV catalog, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.3CPE matchmatch criteria | cpe:2.3:o:siemens:6ed1052-1md08-0ba1_firmware:*:*:*:*:*:*:*:* | ||
<= 8.3CPE matchmatch criteria | cpe:2.3:o:siemens:6ed1052-2md08-0ba1_firmware:*:*:*:*:*:*:*:* | ||
<= 8.3CPE matchmatch criteria | cpe:2.3:o:siemens:6ed1052-1cc08-0ba1_firmware:*:*:*:*:*:*:*:* | ||
<= 8.3CPE matchmatch criteria | cpe:2.3:o:siemens:6ed1052-2cc08-0ba1_firmware:*:*:*:*:*:*:*:* | ||
<= 8.3CPE matchmatch criteria | cpe:2.3:o:siemens:6ed1052-1hb08-0ba1_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.