CVE-2014-2251
First published: Sun Mar 16 2014(Updated: )
The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens S7-1500 CPU firmware | <=1.1.2 | |
| Siemens S7-1500 CPU firmware | =1.0.1 | |
| Siemens S7-1500 CPU firmware | =1.1.0 | |
| Siemens S7-1500 CPU firmware | =1.1.1 | |
| <=1.1.2 | ||
| =1.0.1 | ||
| =1.1.0 | ||
| =1.1.1 |
Remedy
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-2251?
CVE-2014-2251 is considered a medium to high severity vulnerability due to its potential impact on cryptographic protection mechanisms.
How do I fix CVE-2014-2251?
To fix CVE-2014-2251, update the Siemens SIMATIC S7-1500 CPU firmware to version 1.5.0 or later.
What devices are affected by CVE-2014-2251?
CVE-2014-2251 affects Siemens SIMATIC S7-1500 CPU devices with firmware versions prior to 1.5.0.
What is the nature of the vulnerability in CVE-2014-2251?
CVE-2014-2251 involves a weak random-number generator that lacks sufficient entropy, making it vulnerable to cryptographic attacks.
Can CVE-2014-2251 allow session hijacking?
Yes, CVE-2014-2251 can facilitate session hijacking by allowing remote attackers to exploit weak cryptographic protections.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/remedy
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/siemens
- canonical/siemens s7-1500 cpu firmware
- version/siemens s7-1500 cpu firmware/1.1.2
- version/siemens s7-1500 cpu firmware/1.0.1
- version/siemens s7-1500 cpu firmware/1.1.0
- version/siemens s7-1500 cpu firmware/1.1.1