Information disclosure

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7959

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7959

Siemens SIMATIC STEP 7 (TIA Portal) before version 14 stores pre‑shared key data in TIA project files, enabling local attackers with file access to brute‑force and read sensitive information. The vulnerability is described across multiple sources (NVD entry for CVE-2016-7959 and PT Security advis...

CVE-2016-7959: Undefined Security Weakness

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7960: Exposure of Sensitive Information to an Unauthorized Actor

Siemens SIMATIC STEP 7 TIA Portal before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors...

Siemens SIMATIC STEP 7 (TIA Portal) Information Disclosure Vulnerabilities

OVERVIEW Siemens has released a new version of SIMATIC STEP 7 TIA Portal to mitigate information disclosure vulnerabilities. These vulnerabilities were reported directly to Siemens by Dmitry Sklyarov and Gleb Gritsai from Positive Technologies. Siemens has produced a new version to mitigate these...

Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-050-01 Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities that was published February 19, 2015, on the NCCIC/ICS-CERT web site. Siemens has identified two vulnerabilities in its SIMATIC STEP 7 TIA Portal. Siemens...

Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities

OVERVIEW Aleksandr Timorin from Positive Technologies has identified authentication vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. Siemens has produced a service pack that mitigates these vulnerabilities. AFFECTED PRODUCTS The following Siemens products are affected: SIMATI...

CVE-2015-1602

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext 1 protection-level passwords or 2 web-server passwords by leveraging the ability to read these files...

Information disclosure

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors...

Default credentials

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext 1 protection-level passwords or 2 web-server passwords by leveraging the ability to read these files...

CVE-2015-1601

CVE-2015-1601 affects Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1. The root cause is a man-in-the-middle vulnerability in network communications (Port 102/TCP) that can allow attackers to intercept or modify transmitted data, potentially exposing sensitive information or enab...

PT-2015-5381

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC STEP 7 TIA Portal versions 12 and 13 before 13 SP1 Upd1 Description The issue allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors. Recommendations For versions 1...

CVE-2015-1601: Undefined Security Weakness

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors...

PT-2015-5382

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC STEP 7 TIA Portal versions 12 and 13 before 13 SP1 Upd1 Description The issue improperly stores password data within project files. This makes it easier for local users to determine cleartext protection-level passwords or...

CVE-2015-1602: Exposure of Sensitive Information to an Unauthorized Actor

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext 1 protection-level passwords or 2 web-server passwords by leveraging the ability to read these files...

KLA10534 Sensitive information obtain vulnerabilities in Siemens SIMATIC STEP

Improper password store and other uncnown vulnerability were found in SIMATIC STEP 7. By exploiting these vulnerabilities malicious users can obtain sensitive information. These vulnerabilities can be exploited remotely via an unknown vectors. Original advisories Siemens advisory Exploitation...

PT-2015-5375

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC ProSave versions prior to 13 SP1 Siemens SIMATIC CFC versions prior to 8.0 SP4 Upd9 and 8.1 Upd1 Siemens SIMATIC STEP 7 versions prior to 5.5 SP1 HF2, 5.5 SP2 HF7, 5.5 SP3, and 5.5 SP4 HF4 Siemens SIMOTION Scout versions prior ...

CVE-2015-1594: Undefined Security Weakness

Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to ga...

Siemens SIMATIC STEP 7 Sensitive Information Disclosure Vulnerability

Siemens SIMATIC is an automation software with a single engineering environment. A sensitive information disclosure vulnerability exists in Siemens SIMATIC STEP 7, which allows attackers to exploit the vulnerability to gain access to sensitive information due to the use of an insecure hash...