We are not aware of malware exploiting this vulnerability. Is there known malware, which exploits this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability. How the attacker can exploit this vulnerability? This vulnerability can be exploited by a remote authenticated user via the Internet. Full software list in CPE2.3 format available after registration.Ĭan this vulnerability be exploited remotely?.One of the worlds largest producers of energy-efficient, resource-saving technologies, Siemens is a leading supplier of systems for power generation and transmission as well as medical diagnosis. Siemens is a global powerhouse focusing on the areas of electrification, automation and digitalization. An attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.Ĭybersecurity Help is currently unaware of any official solution to address this vulnerability. Siemens SIMATIC STEP 7 version 5.6 About Siemens AG. The vulnerability exists due to missing cryptographic steps in the function that encrypts users' LDAP and RADIUS credentials. The vulnerability allows an attacker to compromise users' passwords. CVSSv3.1: 4.9 ĬWE-ID: CWE-325 - Missing Required Cryptographic Step

Step 7 5.6