Siemens SIMATIC S7-1500 CVE-2014-2251 Insufficient Entropy Vulnerability

Bugtraq ID:	66195
Class:	Design Error
CVE:	CVE-2014-2251
Remote:	Yes
Local:	No
Published:	Mar 12 2014 12:00AM
Updated:	Mar 19 2014 01:13AM
Credit:	Dmitry Serebryannikov, Ilya Karpov, Alexey Osipov, Yury Goltsev, Alex Timorin, Alexey Osipov, and Ilya Karpov from Positive Technologies
Vulnerable:
Not Vulnerable:

Siemens SIMATIC S7-1500 CVE-2014-2251 Insufficient Entropy Vulnerability

Siemens SIMATIC S7-1500 is prone to an insufficient-entropy vulnerability.

Remote attackers can exploit this issue to perform man-in-the-middle attacks and gains unauthorized access to the affected devices. This aids in other attacks.

Versions prior to Siemens SIMATIC S7-1500 1.5.0 are vulnerable.

Siemens SIMATIC S7-1500 CVE-2014-2251 Insufficient Entropy Vulnerability

Attackers can use readily available tools to exploit this issue.

Siemens SIMATIC S7-1500 CVE-2014-2251 Insufficient Entropy Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Siemens SIMATIC S7-1500 CVE-2014-2251 Insufficient Entropy Vulnerability

References:

• Siemens Homepage (Siemens)