ICSA-18-226-01 Siemens SIMATIC STEP 7 and SIMATIC WinCC (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable locally/low skill level to exploit Vendor: Siemens Equipment: SIMATIC STEP 7 TIA Portal and SIMATIC WinCC TIA Portal Vulnerabilities: Incorrect Default Permissions 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Siemens SIMATIC WinCC (TIA Portal) < 14 SP1 XXE Vulnerability

Binary data scadasiemenstiawinccSSA-535640.nbin...

Siemens TIA Portal Detection

Binary data 700178.prm...

Siemens SIMATIC WinCC (TIA Portal) 13 < 13 SP2 / 14 < 14 SP1 Multiple DoS

Binary data scadasiemenstiawincc13SP214SP1.nbin...

Siemens SIMATIC STEP 7 (TIA Portal) < 14 Unquoted Service Path Local Privilege Escalation (SSA-701708)

Binary data scadasiemenstiastep7SSA-701708.nbin...

Siemens SIMATIC WinCC (TIA Portal) < 14 Unquoted Service Path Local Privilege Escalation (SSA-701708)

Binary data scadasiemenstiawinccSSA-701708.nbin...

CVE-2016-8562

A vulnerability has been identified in SIMATIC CP 1543-1 All versions V2.0.28, SIPLUS NET CP 1543-1 All versions V2.0.28. Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these...

CVE-2016-8561

A vulnerability has been identified in SIMATIC CP 1543-1 All versions V2.0.28, SIPLUS NET CP 1543-1 All versions V2.0.28. Users with elevated privileges to TIA-Portal and project data on the engineering station could possibly get privileged access on affected devices...

CVE-2016-8561

A vulnerability has been identified in SIMATIC CP 1543-1 All versions V2.0.28, SIPLUS NET CP 1543-1 All versions V2.0.28. Users with elevated privileges to TIA-Portal and project data on the engineering station could possibly get privileged access on affected devices...

CVE-2016-8561

Summary (CVE-2016-8561) : The Siemens SIMATIC CP 1543-1 and SIPLUS NET CP 1543-1 are affected (versions prior to 2.0.28). The root cause is improper privilege management (CWE-269), enabling users with elevated TIA-Portal and project-data access to gain privileged access on the device. The ICS adv...

CVE-2016-8562

A vulnerability has been identified in SIMATIC CP 1543-1 All versions V2.0.28, SIPLUS NET CP 1543-1 All versions V2.0.28. Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these...

CVE-2016-8562

Siemens SIMATIC CP 1543-1 and SIPLUS NET CP 1543-1 (versions before 2.0.28) are affected by CVE-2016-8562. Under special conditions, SNMP variables on port 161/UDP, which should be read-only, can be written, potentially reducing availability or causing denial-of-service. The ICS advisory notes th...

CVE-2016-8562

A vulnerability has been identified in SIMATIC CP 1543-1 All versions V2.0.28, SIPLUS NET CP 1543-1 All versions V2.0.28. Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these...

CVE-2016-7960

Siemens SIMATIC STEP 7 TIA Portal before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors...

Format string

Siemens SIMATIC STEP 7 TIA Portal before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors...

Information disclosure

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7959

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7959

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7959

Siemens SIMATIC STEP 7 (TIA Portal) before version 14 stores pre‑shared key data in TIA project files, enabling local attackers with file access to brute‑force and read sensitive information. The vulnerability is described across multiple sources (NVD entry for CVE-2016-7959 and PT Security advis...

CVE-2016-7960

Siemens SIMATIC STEP 7 (TIA Portal) prior to version 14 is affected by an information-disclosure vulnerability caused by an improper format for managing TIA project files during version updates. Local attackers with access to engineering workstations or project storage could obtain sensitive conf...