Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2011-4508
HistoryFeb 03, 2012 - 8:55 p.m.

CVE-2011-4508

2012-02-0320:55:01
CWE-287
[email protected]
web.nvd.nist.gov

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.9%

JSON

The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable authentication tokens for cookies, which makes it easier for remote attackers to bypass authentication via a crafted cookie.

Affected configurations

NVD
Node
siemenswincc_flexibleMatch2004
OR
siemenswincc_flexibleMatch2005
OR
siemenswincc_flexibleMatch2007
OR
siemenswincc_flexibleMatch2008
OR
siemenswincc_flexibleMatch2008sp1
OR
siemenswincc_flexibleMatch2008sp2
Node
siemenswinccRange≤v11sp2
OR
siemenswinccMatchv11
OR
siemenswinccMatchv11sp1
Node
siemenssimatic_hmi_panelsMatchcomfort_panels
OR
siemenssimatic_hmi_panelsMatchmobile_panels
OR
siemenssimatic_hmi_panelsMatchmp
OR
siemenssimatic_hmi_panelsMatchop
OR
siemenssimatic_hmi_panelsMatchtp
Node
siemenswincc_runtime_advancedMatchv11
Node
siemenswincc_flexible_runtime

Related

cve 1
prion 1
cvelist 1
ics 2
openvas 2
kaspersky 1
cve
cve
CVE-2011-4508
2022-10-03 16:15:14
prion
prion
Authentication flaw
2012-02-03 20:55:00
cvelist
cvelist
CVE-2011-4508
2022-10-03 16:15:14
ics
ics
Siemens Simatic HMI Authentication Vulnerabilities
2013-04-22 12:00:00
Siemens SIMATIC WinCC Vulnerabilities (UPDATE A)
2018-09-06 12:00:00
openvas
openvas
Multiple Siemens SIMATIC Products Authentication Bypass Vulnerabilities
2011-12-23 00:00:00
Multiple Siemens SIMATIC Products Authentication Bypass Vulnerabilities
2011-12-23 00:00:00
kaspersky
kaspersky
KLA10394 Multiple vulnerabilities in Siemens
2012-01-24 00:00:00

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.9%

JSON
Related for NVD:CVE-2011-4508
cve1prion1cvelist1ics2openvas2kaspersky1