critical10.0
CVE-2013-6920
Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass…
Impact
Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Siemens | Sinamics S\/G Family Firmware | through 4.6 |
| Siemens | Sinamics G110 | All versions |
| Siemens | Sinamics G110d | All versions |
| Siemens | Sinamics G120 | All versions |
| Siemens | Sinamics G120c | All versions |
| Siemens | Sinamics G120d | All versions |
| Siemens | Sinamics G120p | All versions |
| Siemens | Sinamics G130 | All versions |
| Siemens | Sinamics G150 | All versions |
| Siemens | Sinamics G180 | All versions |
| Siemens | Sinamics S110 | All versions |
| Siemens | Sinamics S120 | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-742938.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-742938.pdf
- http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-742938.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-742938.pdf