CVE-2014-2250

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

Code injection

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

Design/Logic Flaw

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257...

Design/Logic Flaw

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted PROFINET packets, a different vulnerability than CVE-2014-2253...

Design/Logic Flaw

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTP packets, a different vulnerability than CVE-2014-2255...

CVE-2014-2258

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTPS packets, a different vulnerability than CVE-2014-2259...

CVE-2014-2252

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted PROFINET packets, a different vulnerability than CVE-2014-2253...

CVE-2014-2256

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257...

CVE-2014-2258

CVE-2014-2258 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware before 4.0. A crafted HTTPS packet can trigger a defect-mode transition, causing a denial of service. The issue is distinct from CVE-2014-2259. The vulnerability is triggered via remote network access to the device’s HTTPS handl...

CVE-2014-2256

CVE-2014-2256 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware before 4.0. The vulnerability is due to improper input validation in the device’s handling of packets, enabling a remote attacker to trigger a defect-mode transition and cause a denial of service via crafted ISO-TSAP packets. De...

CVE-2014-2254

CVE-2014-2254 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware prior to 4.0. The vulnerability allows remote DoS (defect-mode transition) by sending crafted HTTP packets to the device’s web server (Port 80/443). Root cause is related to improper handling within the device’s HTTP interface, ...

CVE-2014-2252

Summary (CVE-2014-2252) : Siemens SIMATIC S7-1200 CPU PLC devices with firmware prior to 4.0 are affected by a vulnerability that allows remote attackers to cause a denial of service (defect-mode transition) by sending crafted PROFINET packets. The issue is tied to improper handling that enables ...

CVE-2014-2250

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

CVE-2014-2250

CVE-2014-2250 concerns Siemens SIMATIC S7-1200 CPUs with firmware before 4.0, where the PRNG has insufficient entropy. This weaknesses can enable remote attackers to defeat cryptographic protections and hijack sessions via unspecified vectors. Public material ties this to the S7-1200 family and n...

CVE-2014-2254

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTP packets, a different vulnerability than CVE-2014-2255...

Siemens SIMATIC S7-1200多个漏洞

CVE ID: CVE-2014-2249,CVE-2014-2250,CVE-2014-2252,CVE-2014-2254,CVE-2014-2256,CVE-2014-2258 SIMATIC S7-1200是可编程控制器，可实现简单却高度精确的自动化任务。 Siemens SIMATIC S7-1200 4.0.0之前版本在实现上存在多个漏洞，可被恶意利用执行跨站请求伪造、劫持用户会话、造成拒绝服务。 1、向TCP端口443发送特制的数据包造成的错误可造成设备进入defect模式。 2、随机生成器内弱熵相关错误，可导致劫持另外用户的会话。...

CVE-2014-2249

Cross-site request forgery CSRF vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-2249

CVE-2014-2249 is a CSRF vulnerability in Siemens SIMATIC S7-1500 (< v1.5) and S7-1200 (

Siemens SIMATIC S7-1200 CPU Web Vulnerabilities

OVERVIEW Siemens ProductCERT and Ralf Spenneberg, Hendrik Schwartke, and Maik Brüggemann from OpenSource Training have reported two vulnerabilities in the Siemens SIMATIC S7-1200 CPU family. Siemens has produced a new product release that mitigates these vulnerabilities. AFFECTED PRODUCTS The...

Siemens S7 1214C PN-DCP Request Message Buffer Overflow Vulnerability

The SIMATIC S7-1200 is a small controller module used in low-end discrete automation systems and stand-alone automation. hardware CPU 1214C under the Siemens S7-1200 family supports the Data Link Layer Device Management Protocol PN-DCP PROFINET Discovery and Configuration Protocol for local area...