What is the CVSS score of CVE-2021-37186?

CVE-2021-37186 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2021-37186?

Yes, a patch is available for CVE-2021-37186. Update the affected software to the latest version immediately.

Logo Cmr2020 Firmware CVE-2021-37186

Q: Which versions of Logo Cmr2020 Firmware are affected by CVE-2021-37186?

A vulnerability has been identified in LOGO!. Rated medium severity (CVSS 5.4), this vulnerability is no authentication required, low attack complexity.. A patch is available.

MEDIUM

Use of Insufficiently Random Values (CWE-330)

2021-09-14 productcert@siemens.com

Information Disclosure Logo Cmr2020 Firmware Logo Cmr2040 Firmware Simatic Rtu3010C Firmware Simatic Rtu3030C Firmware Simatic Rtu3031C Firmware Simatic Rtu3041C Firmware

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Sep 14, 2021 - 11:15 nvd

MEDIUM 5.4

DescriptionNVD

A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIMATIC RTU3031C (All versions < V4.0.9), SIMATIC RTU3041C (All versions < V4.0.9). The underlying TCP/IP stack does not properly calculate the random numbers used as ISN (Initial Sequence Numbers). An adjacent attacker with network access to the LAN interface could interfere with traffic, spoof the connection and gain access to sensitive information.

AnalysisAI

A vulnerability has been identified in LOGO!. Rated medium severity (CVSS 5.4), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-330. A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIMATIC RTU3031C (All versions < V4.0.9), SIMATIC RTU3041C (All versions < V4.0.9). The underlying TCP/IP stack does not properly calculate the random numbers used as ISN (Initial Sequence Numbers). An adjacent attacker with network access to the LAN interface could interfere with traffic, spoof the connection and gain access to sensitive information. Affected products include: Siemens Logo\! Cmr2020 Firmware, Siemens Logo\! Cmr2040 Firmware, Siemens Simatic Rtu3010C Firmware, Siemens Simatic Rtu3030C Firmware, Siemens Simatic Rtu3031C Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.