PT-2015-5233

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC TIA Portal versions prior to 13 SP1 Siemens SIMATIC WinCC flexible versions prior to 2008 SP3 Up7 Description The issue concerns the remote-management module in certain Siemens products, where credentials are not properly...

Siemens SIMATIC WinCC Sm@rtClient app Information Disclosure Vulnerability

Siemens SIMATIC WinCC is the monitoring control and data acquisition SCADA and HMI system. An information disclosure vulnerability exists in Siemens SIMATIC WinCC Sm@rtClient app versions prior to 1.0.2, which allows an attacker to discover Sm@rtServer credentials by exploiting an error in the...

Siemens SIMATIC WinCC Sm@rtClient app information disclosure vulnerability (CNVD-2015-00426)

Siemens SIMATIC WinCC is the monitoring control and data acquisition SCADA and HMI system. An information disclosure vulnerability exists in the Siemens SIMATIC WinCC Sm@rtClient app prior to version 1.0.2, which allows an attacker to extract passwords from srage via an unspecified vector...

CVE-2014-5233

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism...

PT-2015-3791

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC Sm@rtClient app version 1.0.1 and earlier Description The issue allows physically proximate attackers to discover Sm@rtServer credentials due to an error in the credential-processing mechanism. Recommendations For version...

PT-2015-3790

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC Sm@rtClient app versions prior to 1.0.2 Description The issue allows local users to bypass an intended application-password requirement. This is achieved by leveraging the running of the app in the background state...

PT-2015-3789

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC Sm@rtClient app versions prior to 1.0.2 Description The issue allows physically proximate attackers to extract the password from storage. Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later to...

CVE-2014-5232: Undefined Security Weakness

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an intended application-password requirement by leveraging the running of the app in the background state...

CVE-2014-5233: Exposure of Sensitive Information to an Unauthorized Actor

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism...

CVE-2014-5231: Exposure of Sensitive Information to an Unauthorized Actor

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors...

CVE-2014-8552

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets...

CVE-2014-8552: Exposure of Sensitive Information to an Unauthorized Actor

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets...

CVE-2014-8551: Improper Control of Generation of Code

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets...

PT-2014-8613

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions 7.0 through 7.0 SP3 Siemens SIMATIC WinCC versions 7.2 through 7.2 before Update 9 Siemens SIMATIC WinCC versions 7.3 through 7.3 before Update 2 Siemens SIMATIC PCS 7 versions 7.1 through 7.1 SP4 Siemens SIMATIC...

PT-2014-8612

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions 7.0 through 7.3 before Update 2 Siemens SIMATIC PCS 7 versions 7.1 through 8.1 Siemens TIA Portal version 13 before Update 6 Description The issue allows remote attackers to execute arbitrary code via crafted...

Siemens SIMATIC WinCC OA Multiple Vulnerabilities

OVERVIEW Researchers Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies have identified multiple vulnerabilities in the Siemens SIMATIC WinCC Open Architecture OA application. Siemens has produced updates that mitigate these vulnerabilities. These vulnerabilities could be...

Siemens Patches Five Vulnerabilities in SIMATIC WinCC for PCS 7

Siemens has patched five vulnerabilities in its SIMATIC PCS 7 system that could result in privilege escalation and give an attacker unauthenticated access to sensitive data. The flaws technically exist in WinCC, a SCADA supervisory control and data acquisition and HMI human-machine interface syst...

CVE-2014-4682

The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request...

CVE-2014-4685

Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveraging weak system-object access control...

CVE-2014-4686

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during...