CVE-2018-13799: Improper Privilege Management

A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior All versions V3.14-P021. Improper access control to a data point of the affected product could allow an unauthenticated remote user to escalate its privileges in the context of SIMATIC WinCC OA V3.14. This vulnerability could...

ICSA-18-254-04 Siemens SIMATIC WinCC OA

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC WinCC OA Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated remote user to escalate...

Siemens SIMATIC WinCC (TIA Portal) 10.x < 14 SP1 Upd6 Multiple Vulnerabilities (SSA-979106)

Binary data scadasiemenstiawinccssa-979106.nbin...

ICSA-18-226-01 Siemens SIMATIC STEP 7 and SIMATIC WinCC (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable locally/low skill level to exploit Vendor: Siemens Equipment: SIMATIC STEP 7 TIA Portal and SIMATIC WinCC TIA Portal Vulnerabilities: Incorrect Default Permissions 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Siemens OpenSSL Vulnerability in Industrial Products (Update E)

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Exploitable remotely Vendor : Siemens Equipment : Industrial Products Vulnerability : Cleartext Transmission of Sensitive Information 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-18-226-02 Siemens...

CVE-2018-4832

A vulnerability has been identified in OpenPCS 7 V7.1 and earlier All versions, OpenPCS 7 V8.0 All versions, OpenPCS 7 V8.1 All versions V8.1 Upd5, OpenPCS 7 V8.2 All versions, OpenPCS 7 V9.0 All versions V9.0 Upd1, SIMATIC BATCH V7.1 and earlier All versions, SIMATIC BATCH V8.0 All versions V8.0...

CVE-2018-4832

CVE-2018-4832 affects Siemens SPPA-T3000 and related OpenPCS/WinCC/BATCH/Route Control components. The vulnerability stems from improper input validation in the RPC service, enabling a remote attacker with network access to cause a DoS in remote and local communication, requiring a reboot to rest...

CVE-2018-4832: Improper Input Validation

A vulnerability has been identified in OpenPCS 7 V7.1 and earlier All versions, OpenPCS 7 V8.0 All versions, OpenPCS 7 V8.1 All versions V8.1 Upd5, OpenPCS 7 V8.2 All versions, OpenPCS 7 V9.0 All versions V9.0 Upd1, SIMATIC BATCH V7.1 and earlier All versions, SIMATIC BATCH V8.0 All versions V8.0...

CVE-2018-4847

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App All versions V1.4. Insufficient protection of sensitive information e.g. session key for accessing server in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read...

CVE-2018-4847

The CVE concerns SIMATIC WinCC OA Operator iOS App (all versions prior to v1.4). Affected component: the app’s data directory where sensitive information (e.g., session keys) can be read if an attacker has physical access. Root cause: Insufficient protection of sensitive information leading to in...

CVE-2018-4847: Insertion of Sensitive Information into Externally-Accessible File or Directory

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App All versions V1.4. Insufficient protection of sensitive information e.g. session key for accessing server in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read...

SIMATIC WinCC OA Operator iOS Information Disclosure Vulnerability

SIMATIC WinCC OA Operator iOS is an application that makes it easy to control SIMATIC WinCC OA devices from a mobile device. An information disclosure vulnerability exists in SIMATIC WinCC OA Operator iOS. It allows an attacker to read unencrypted data from the application's directory. A...

Siemens SIMATIC WinCC OA Operator IOS App (Update A)

1. EXECUTIVE SUMMARY CVSS v3 4.0 Vendor : Siemens Equipment : SIMATIC WinCC OA iOS App Vulnerability : File and Directory Information Exposure. 2 UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-18-109-01 Siemens SIMATIC WinCC OA Operator iOS App that...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

CVE-2018-4844

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

CVE-2018-4844

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

CVE-2018-4844: Improper Access Control

A vulnerability has been identified in SIMATIC WinCC OA UI for Android All versions V3.15.10, SIMATIC WinCC OA UI for iOS All versions V3.15.10. Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache...

ICSA-18-081-01 Siemens SIMATIC WinCC OA UI Mobile App

CVSS v3 5.1 ATTENTION: Exploitable from an adjacent network. Vendor: Siemens Equipment: SIMATIC WinCC OA UI mobile app Vulnerability: Improper Access Control AFFECTED PRODUCTS Siemens reports that this vulnerability affects the following products: SIMATIC WinCC OA UI for Android: All versions pri...

ICSA-18-018-01A Siemens SIMATIC WinCC Add-On (Update A)

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SIMATIC WinCC Add-On Vulnerabilities: Stack-based Buffer Overflow, Improper Input Validation, Improper Restriction of Operations within the Bounds of a Memory Buffer, Security Features, Improper...

CVE-2017-12069

An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server LDS before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 All versions V8.1 and earlier, SIMATIC WinCC All versions V7.4 SP1, SIMATIC WinCC Runtime...