CVE-2014-2253

CVE-2014-2253 affects Siemens SIMATIC S7-1500 CPU PLCs with firmware before 1.5.0. The vulnerability allows remote attackers to cause a denial of service (defect‑mode transition) by sending crafted Profinet packets. Public details in the connected docs confirm the affected product family, the att...

CVE-2014-2247: Undefined Security Weakness

The integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject headers via unspecified vectors...

CVE-2014-2249: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 and SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-2248: Undefined Security Weakness

Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2014-2257: Undefined Security Weakness

Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service defect-mode transition via crafted ISO-TSAP packets...

CVE-2014-2251: Undefined Security Weakness

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors...

CVE-2014-2246: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4589

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Description The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition, by sending crafted HTTPS packets. Recommendations For versions...

PT-2014-1955

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Siemens SIMATIC S7-1200 CPU PLC devices versions prior to 4.0 Description A cross-site request forgery CSRF issue affects the software, allowing remote attackers to hijack the...

PT-2014-4587

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Description The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition, by sending crafted HTTP packets. Recommendations For versions...

PT-2014-4583

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Description The issue allows remote attackers to inject headers via unspecified vectors, potentially affecting the integrated web server on the devices. Recommendations For versio...

PT-2014-4582

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Description A cross-site scripting XSS issue exists in the integrated web server, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to...

PT-2014-4586

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Description The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition, by sending crafted Profinet packets. Recommendations For version...

PT-2014-4588

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Description The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition, by sending crafted ISO-TSAP packets. Recommendations For version...

CVE-2014-0779

The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build...

Design/Logic Flaw

The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build...

CVE-2014-0779 Schneider Electric StruxureWare SCADA Expert ClearSCADA Improper Restriction of Operations within the Bounds of a Memory Buffer

The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build...

CVE-2014-0779

The CVE-2014-0779 issue affects the Kepware KepServerEX V4 PLC Driver in the ServerMain.exe component of Schneider Electric StruxureWare SCADA Expert ClearSCADA, impacting multiple release/build combos listed in the NVD entry (2010 R2, 2010 R2.1, 2010 R3, 2010 R3.1, 2013 R1, 2013 R1.1, 2013 R1.1a...

Yokogawa Multiple Products Vulnerabilities

OVERVIEW Yokogawa reports that several buffer overflow vulnerabilities affect several of its products. Juan Vazquez of Rapid7 Inc.,Rapid7 Inc., http://www.rapid7.com, web site last accessed May 13, 2014. and independent researcher Julian Vilas Diaz reported to CERT/CC that they identified several...

Attacking ICS Systems 'Like Hacking in the 1980s'

PUNTA CANA–Here’s how nuts the world of ICS security is: Jonathan Pollet, a security consultant who specializes in ICS systems, was at a Texas amusement park recently and the ride he was waiting for was malfunctioning. The operator told him the ride used a Siemens PLC as part of the control syste...