Deserialization in Siemens Logo! Soft Comfort
CVE-2019-10924
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability, a valid user must open a manipulated project file. No further privileges are required on the target system. The vulnerability could compromise the confidentiality, integrity and availability of the engineering station. At the time of advisory publication no public exploitation of this security vulnerability was known.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (68.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 68.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Siemens Logo! Soft Comfort — versions All versions < V8.3
- Siemens Logo\! Soft Comfort
Weakness classification (CWE)
References
- www.securityfocus.com/bid/108368 (VDB Entry, Third Party Advisory, vdb-entry)
- cert-portal.siemens.com/productcert/pdf/ssa-102144.pdf (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-10924?
- CVE-2019-10924 is a high-severity vulnerability in Siemens Logo! Soft Comfort, classified under Deserialization of Untrusted Data. CVSS score: 7.8/10. Published 2019-05-14.
- How severe is CVE-2019-10924?
- High severity. CVSS v3 base score is 7.8 out of 10.