Sign-up

ID

VAR-202102-0296


CVE

CVE-2020-25238


TITLE

Siemens Totally Integrated Automation Portal vulnerable to privilege escalation due to Node.js paths

Trust: 0.8

sources: CERT/CC: VU#466044

DESCRIPTION

A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in specific folders could allow a local attacker to execute code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system. Siemens Totally Integrated Administrator (TIA) fails to properly set the module search path to be used by a privileged Node.js component, which can allow an unprivileged Windows user to run arbitrary code with SYSTEM privileges. The PCS neo administration console is reported to be affected as well.CVE-2020-25238 AffectedCVE-2020-25238 Affected. TIA Administrator is a web-based framework that can contain different functional modules for management tasks, as well as functions for managing SIMATIC software and licenses. Siemens TIA Administrator has a privilege escalation vulnerability

Trust: 2.88

sources: NVD: CVE-2020-25238 // CERT/CC: VU#466044 // JVNDB: JVNDB-2020-015981 // CNVD: CNVD-2021-11833

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-11833

AFFECTED PRODUCTS

vendor:siemensmodel:simatic process control system neoscope:ltversion:3.1

Trust: 1.0

vendor:siemensmodel:totally integrated automation portalscope:eqversion:16

Trust: 1.0

vendor:siemensmodel:totally integrated automation portalscope:eqversion:15.1

Trust: 1.0

vendor:siemensmodel:totally integrated automation portalscope:eqversion:15

Trust: 1.0

vendor:シーメンスmodel:simatic pcs neoscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:totally integrated automation ポータルscope: - version: -

Trust: 0.8

vendor:siemensmodel:tia portalscope:eqversion:v16

Trust: 0.6

vendor:siemensmodel:pcs neoscope: - version: -

Trust: 0.6

vendor:siemensmodel:tia portalscope:eqversion:v15

Trust: 0.6

vendor:siemensmodel:tia portalscope:eqversion:v15.1

Trust: 0.6

sources: CNVD: CNVD-2021-11833 // JVNDB: JVNDB-2020-015981 // NVD: CVE-2020-25238

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-25238
value: HIGH

Trust: 1.0

NVD: CVE-2020-25238
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-11833
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202102-891
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-25238
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-11833
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-25238
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-25238
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-11833 // JVNDB: JVNDB-2020-015981 // CNNVD: CNNVD-202102-891 // NVD: CVE-2020-25238

PROBLEMTYPE DATA

problemtype:CWE-427

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:Inappropriate access control (CWE-284) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-015981 // NVD: CVE-2020-25238

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202102-891

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202102-891

PATCH

title:SSA-428051url:https://cert-portal.siemens.com/productcert/pdf/ssa-428051.pdf

Trust: 0.8

title:Patch for Siemens TIA Administrator privilege escalation vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/248781

Trust: 0.6

title:Multiple Siemens product Fixes for access control error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=141312

Trust: 0.6

sources: CNVD: CNVD-2021-11833 // JVNDB: JVNDB-2020-015981 // CNNVD: CNNVD-202102-891

EXTERNAL IDS

db:NVDid:CVE-2020-25238

Trust: 3.8

db:CERT/CCid:VU#466044

Trust: 3.2

db:ICS CERTid:ICSA-21-040-05

Trust: 2.4

db:SIEMENSid:SSA-428051

Trust: 2.2

db:JVNid:JVNVU91083521

Trust: 0.8

db:JVNDBid:JVNDB-2020-015981

Trust: 0.8

db:CNVDid:CNVD-2021-11833

Trust: 0.6

db:CNNVDid:CNNVD-202102-891

Trust: 0.6

sources: CERT/CC: VU#466044 // CNVD: CNVD-2021-11833 // JVNDB: JVNDB-2020-015981 // CNNVD: CNNVD-202102-891 // NVD: CVE-2020-25238

REFERENCES

url:https://www.kb.cert.org/vuls/id/466044

Trust: 3.0

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-040-05

Trust: 3.0

url:https://cert-portal.siemens.com/productcert/pdf/ssa-428051.pdf

Trust: 2.2

url:http://jvn.jp/vu/jvnvu91083521

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-25238

Trust: 0.8

sources: CNVD: CNVD-2021-11833 // JVNDB: JVNDB-2020-015981 // CNNVD: CNNVD-202102-891 // NVD: CVE-2020-25238

CREDITS

This document was written by Will Dormann.Statement Date:   February 09, 2021

Trust: 0.8

sources: CERT/CC: VU#466044

SOURCES

db:CERT/CCid:VU#466044
db:CNVDid:CNVD-2021-11833
db:JVNDBid:JVNDB-2020-015981
db:CNNVDid:CNNVD-202102-891
db:NVDid:CVE-2020-25238

LAST UPDATE DATE

2024-08-14T12:16:00.990000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#466044date:2021-02-09T00:00:00
db:CNVDid:CNVD-2021-11833date:2021-04-12T00:00:00
db:JVNDBid:JVNDB-2020-015981date:2021-10-29T08:04:00
db:CNNVDid:CNNVD-202102-891date:2022-10-24T00:00:00
db:NVDid:CVE-2020-25238date:2022-10-21T18:21:51.103

SOURCES RELEASE DATE

db:CERT/CCid:VU#466044date:2021-02-09T00:00:00
db:CNVDid:CNVD-2021-11833date:2021-02-22T00:00:00
db:JVNDBid:JVNDB-2020-015981date:2021-10-29T00:00:00
db:CNNVDid:CNNVD-202102-891date:2021-02-09T00:00:00
db:NVDid:CVE-2020-25238date:2021-02-09T17:15:13.610