Siemens LOGO! Series Buffer Overflow Vulnerability Allowing Remote Code Execution

A buffer overflow vulnerability has been identified in multiple LOGO! 8 BM devices, including SIPLUS variants. The issue arises because the affected devices do not properly validate the structure of TCP packets in several methods. This lack of validation could allow an attacker to cause buffer overflows, gain control over the instruction counter, and execute custom code.

Impact

Exploitation of this vulnerability could lead to a buffer overflow, allowing for arbitrary code execution on the affected device.

Remediation

Users are advised to protect the LSC access to the device with a strong password. For specific product remediations or mitigations, refer to the Siemens Security Advisory SSA-267056.