Siemens Devices Store Passwords in Plaintext: A Recipe for Disaster!
As of January 10, 2023, CISA will halt updates on ICS security advisories for Siemens product vulnerabilities beyond initial notifications. For the latest on these vulnerabilities, visit Siemens’ ProductCERT Security Advisories.
Hot Take:
So, Siemens’ LOGO! devices are storing passwords in clear text, and CISA is like, “That’s all folks!” when it comes to updates? Looks like you’ll need to guard your industrial controllers like they’re the last cookie in the jar.
Key Points:
- Siemens’ LOGO! devices are storing passwords in plaintext.
- The vulnerability is rated CVSS v4 5.1, which is relatively moderate.
- Physical access to the device is required to exploit the vulnerability.
- No fix is planned; physical security is the recommended mitigation.
- CISA will no longer update advisories on Siemens’ product vulnerabilities.
Already a member? Log in here