Details of VAR-202007-1235

ID

VAR-202007-1235

CVE

CVE-2020-7584

TITLE

SIMATIC S7-200 SMART CPU Resource Depletion Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-007898

DESCRIPTION

A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1). Affected devices do not properly handle large numbers of new incomming connections and could crash under certain circumstances. An attacker may leverage this to cause a Denial-of-Service situation. SIMATIC S7-200 SMART CPU Is vulnerable to a resource exhaustion.Denial of service (DoS) It may be put in a state. Siemens SIMATIC S7-200 Smart is a programmable logic controller (PLC) of Germany's Siemens (Siemens) company used in small and medium-sized automation systems. Attackers can use vulnerabilities to cause denial of service

Trust: 2.16

sources: NVD: CVE-2020-7584 // JVNDB: JVNDB-2020-007898 // CNVD: CNVD-2020-40865

IOT TAXONOMY

category:

['ICS', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-40865

AFFECTED PRODUCTS

vendor:	siemens	model:	simatic s7-200 smart st cpu	scope:	gte	version:	2.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-200 smart st cpu	scope:	lt	version:	2.5.1	Trust: 1.0
vendor:	siemens	model:	simatic s7-200 smart sr cpu	scope:	gte	version:	2.2	Trust: 1.0
vendor:	siemens	model:	simatic s7-200 smart sr cpu	scope:	lt	version:	2.5.1	Trust: 1.0
vendor:	シーメンス	model:	simatic s7-200 smart	scope:	eq	version:	-	Trust: 0.8
vendor:	シーメンス	model:	simatic s7-200 smart	scope:	lt	version:	simatic s7-200 smart firmware 2.2 that's all 2.5.1	Trust: 0.8
vendor:	siemens	model:	simatic s7-200 smart cpu family	scope:	gte	version:	v2.2,<v2.5.1	Trust: 0.6

sources: CNVD: CNVD-2020-40865 // JVNDB: JVNDB-2020-007898 // NVD: CVE-2020-7584

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-7584
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-7584
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-40865
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202007-582
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-7584
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-40865
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-7584
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-7584
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-40865 // JVNDB: JVNDB-2020-007898 // CNNVD: CNNVD-202007-582 // NVD: CVE-2020-7584

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.0
problemtype:	Resource exhaustion (CWE-400) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-007898 // NVD: CVE-2020-7584

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202007-582

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202007-582

PATCH

title:	SSA-589181	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-589181.pdf	Trust: 0.8
title:	Patch for Denial of Service Vulnerability in Siemens SIMATIC S7-200 Smart CPU Series	url:	https://www.cnvd.org.cn/patchInfo/show/226103	Trust: 0.6
title:	SIMATIC S7-200 SMART SR CPU and ST CPU Remediation of resource management error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=124357	Trust: 0.6

sources: CNVD: CNVD-2020-40865 // JVNDB: JVNDB-2020-007898 // CNNVD: CNNVD-202007-582

EXTERNAL IDS

db:	NVD	id:	CVE-2020-7584	Trust: 3.0
db:	SIEMENS	id:	SSA-589181	Trust: 2.2
db:	ICS CERT	id:	ICSA-20-196-06	Trust: 1.4
db:	JVNDB	id:	JVNDB-2020-007898	Trust: 0.8
db:	CNVD	id:	CNVD-2020-40865	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2387	Trust: 0.6
db:	CNNVD	id:	CNNVD-202007-582	Trust: 0.6

sources: CNVD: CNVD-2020-40865 // JVNDB: JVNDB-2020-007898 // CNNVD: CNNVD-202007-582 // NVD: CVE-2020-7584

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-589181.pdf	Trust: 2.2
url:	https://nvd.nist.gov/vuln/detail/cve-2020-7584	Trust: 1.4
url:	https://us-cert.cisa.gov/ics/advisories/icsa-20-196-06	Trust: 1.4
url:	https://vigilance.fr/vulnerability/simatic-denial-of-service-via-incomming-connection-32814	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2387/	Trust: 0.6

sources: CNVD: CNVD-2020-40865 // JVNDB: JVNDB-2020-007898 // CNNVD: CNNVD-202007-582 // NVD: CVE-2020-7584

SOURCES

db:	CNVD	id:	CNVD-2020-40865
db:	JVNDB	id:	JVNDB-2020-007898
db:	CNNVD	id:	CNNVD-202007-582
db:	NVD	id:	CVE-2020-7584

LAST UPDATE DATE

2024-08-14T14:03:37.698000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-40865	date:	2020-07-19T00:00:00
db:	JVNDB	id:	JVNDB-2020-007898	date:	2020-09-01T00:00:00
db:	CNNVD	id:	CNNVD-202007-582	date:	2020-07-20T00:00:00
db:	NVD	id:	CVE-2020-7584	date:	2020-07-17T18:33:25.747

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-40865	date:	2020-07-19T00:00:00
db:	JVNDB	id:	JVNDB-2020-007898	date:	2020-08-28T00:00:00
db:	CNNVD	id:	CNNVD-202007-582	date:	2020-07-14T00:00:00
db:	NVD	id:	CVE-2020-7584	date:	2020-07-14T14:15:18.650