CVE-2020-7589: Siemens LOGO! 8 BM Information Disclosure

CVE-2020-7589 Overview

A critical authentication bypass vulnerability has been identified in Siemens LOGO! 8 BM programmable logic controllers (PLCs), including SIPLUS variants. This vulnerability allows an unauthenticated attacker with network access to port 135/tcp to read and modify device configuration and obtain project files from affected devices. The flaw stems from missing authentication for critical functions (CWE-306), enabling complete compromise of device confidentiality and integrity without any user interaction.

Critical Impact

Unauthenticated remote attackers can read and modify device configurations and extract project files, potentially compromising industrial control systems and operational technology (OT) environments.

Affected Products

• Siemens LOGO! 8 BM (All firmware versions)
• Siemens LOGO! 8 BM SIPLUS variants (All versions)
• Siemens LOGO! 8 BM Firmware

Discovery Timeline

• June 10, 2020 - CVE-2020-7589 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-7589

Vulnerability Analysis

This vulnerability affects Siemens LOGO! 8 BM programmable logic controllers, which are compact automation devices commonly used in small-scale industrial and building automation applications. The core issue lies in the lack of authentication mechanisms protecting critical device functions accessible via network port 135/tcp.

The vulnerability enables unauthorized access to device configuration data and project files, which may contain sensitive operational logic, network credentials, and system parameters. In industrial control system (ICS) environments, this type of access could allow attackers to understand facility operations, identify additional attack vectors, or directly manipulate device behavior.

The network-accessible nature of this flaw means any attacker who can reach the device on the network can exploit it without credentials or user interaction. This is particularly concerning in environments where LOGO! 8 BM devices may be inadvertently exposed to broader networks or the internet.

Root Cause

The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The affected Siemens LOGO! 8 BM devices fail to implement proper authentication controls for sensitive management functions exposed on TCP port 135. This design flaw allows any network-accessible client to access configuration and project file retrieval functions that should require authentication.

Attack Vector

The attack vector is network-based, requiring only network connectivity to the target device on port 135/tcp. An attacker can exploit this vulnerability by:

1. Identifying exposed Siemens LOGO! 8 BM devices on the network
2. Connecting to port 135/tcp without providing authentication credentials
3. Issuing requests to read device configuration parameters
4. Extracting project files containing operational logic and potentially sensitive data
5. Modifying device configurations to alter device behavior

The attack requires no user interaction and can be conducted by any unauthenticated attacker with network access to the vulnerable device. Given the lack of authentication, exploitation complexity is low.

Detection Methods for CVE-2020-7589

Indicators of Compromise

• Unexpected network connections to port 135/tcp on LOGO! 8 BM devices from unauthorized sources
• Configuration changes to LOGO! 8 BM devices that were not authorized by operations personnel
• Anomalous project file access or transfer activity from PLC devices
• Network scanning activity targeting TCP port 135 across ICS/OT network segments

Detection Strategies

• Implement network monitoring to detect unauthorized connections to port 135/tcp on Siemens LOGO! 8 BM devices
• Deploy ICS-aware intrusion detection systems (IDS) to identify exploitation attempts targeting Siemens PLCs
• Configure SIEM alerting for connection attempts to LOGO! 8 BM devices from non-whitelisted IP addresses
• Monitor for configuration drift on affected devices using configuration management tools

Monitoring Recommendations

• Establish baseline network behavior for LOGO! 8 BM devices and alert on deviations
• Log all connections to TCP port 135 on ICS network segments for forensic analysis
• Implement network segmentation monitoring to detect lateral movement attempts toward OT devices
• Review access logs and network flow data regularly for signs of unauthorized device access

How to Mitigate CVE-2020-7589

Immediate Actions Required

• Apply network segmentation to isolate Siemens LOGO! 8 BM devices from untrusted networks
• Block external access to port 135/tcp on affected devices using firewalls or access control lists
• Review and audit current device configurations for unauthorized modifications
• Implement defense-in-depth strategies including VPNs for remote access to ICS environments
• Consult the Siemens Security Advisory SSA-817401 for vendor-specific guidance

Patch Information

At the time of the initial advisory publication, Siemens provided mitigation guidance through their Security Advisory SSA-817401. Organizations should consult this advisory and the US-CERT ICS Advisory ICSA-20-161-03 for the latest patch availability and remediation guidance. Contact Siemens support for firmware updates that address this vulnerability.

Workarounds

• Restrict network access to port 135/tcp using firewall rules to allow only trusted management hosts
• Place affected devices behind properly configured network security controls and VPN gateways
• Disable remote network access to LOGO! 8 BM devices if not operationally required
• Implement network intrusion prevention systems (IPS) to block exploitation attempts
• Use dedicated management networks for ICS device administration

# Example firewall rule to restrict access to LOGO! 8 BM devices
# Allow only authorized management stations to access port 135/tcp
iptables -A INPUT -p tcp --dport 135 -s 192.168.100.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 135 -j DROP