CVE-2013-6920
Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.
- Score
- CVSS 2.0 10.0 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2013-12-07
- Last modified
- 2024-08-06
- Weaknesses
- CWE-287
Affected products
- Sinamics G110 (Siemens)
- Sinamics G110d (Siemens)
- Sinamics G120 (Siemens)
- Sinamics G120c (Siemens)
- Sinamics G120d (Siemens)
- Sinamics G120p (Siemens)
- Sinamics G130 (Siemens)
- Sinamics G150 (Siemens)
- Sinamics G180 (Siemens)
- Sinamics S110 (Siemens)
- Sinamics S120 (Siemens)
- Sinamics S120cm (Siemens)
- Sinamics S150 (Siemens)
- Sinamics S/g Family Firmware (Siemens)
References
- http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-742938.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-742938.pdf
