PT-2015-5382

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC STEP 7 TIA Portal versions 12 and 13 before 13 SP1 Upd1 Description The issue improperly stores password data within project files. This makes it easier for local users to determine cleartext protection-level passwords or...

CVE-2015-1601: Undefined Security Weakness

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors...

CVE-2015-1602: Exposure of Sensitive Information to an Unauthorized Actor

Siemens SIMATIC STEP 7 TIA Portal 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext 1 protection-level passwords or 2 web-server passwords by leveraging the ability to read these files...

PT-2015-5381

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC STEP 7 TIA Portal versions 12 and 13 before 13 SP1 Upd1 Description The issue allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors. Recommendations For versions 1...

Siemens SIMATIC STEP 7 (TIA Portal) Detection

Binary data scadaappsiemenstiastep7detect.nbin...

Siemens SIMATIC WinCC (TIA Portal) 13 < 13 SP1 Multiple Vulnerabilities (SSA-543623)

Binary data scadasiemenstiawinccmultiplevulnerabilitiesSSA-543623.nbin...

Siemens SIMATIC WinCC (TIA Portal) Detection

Binary data scadaappsiemenstiawinccdetect.nbin...

Siemens SIMATIC STEP 7 (TIA Portal) < 1300.100.2501.1 Multiple Vulnerabilities (SSA-315836)

Binary data scadasiemenstiamultiplevulnerabilitiesSSA-315836.nbin...

Siemens SIMATIC STEP 7 Security Bypass Vulnerability

Siemens SIMATIC is an automation software with a single engineering environment. A security vulnerability exists in Siemens SIMATIC STEP 7 due to device user privileged information in SIMATIC STEP 7 residing in an unprotected TIA Portal project, which allows an attacker to exploit the vulnerabili...

Siemens SIMATIC STEP 7 TIA Portal Man-in-the-Middle Attack Information Disclosure Vulnerability

Siemens SIMATIC is an automation software with a single engineering environment. A man-in-the-middle attack vulnerability exists in Siemens SIMATIC STEP 7 TCP port 102, which could be exploited by an attacker to intercept or modify communications...

CVE-2015-1356

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file...

CVE-2015-1355

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack...

Code injection

The remote-management module in the 1 Multi Panels, 2 Comfort Panels, and 3 RT Advanced functionality in Siemens SIMATIC WinCC TIA Portal before 13 SP1 and in the 4 panels and 5 runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit,...

Default credentials

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack...

Authorization

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file...

CVE-2015-1356

Siemens SIMATIC STEP 7 TIA Portal (pre-13 SP1) stores device user privileges in project files with insufficient integrity protection, enabling modification of authorization data via a manipulated file and leading to privilege escalation. Mitigation: apply Siemens STEP 7 TIA Portal V13 Service Pac...

CVE-2015-1355

Siemens SIMATIC STEP 7 TIA Portal (all versions prior to V13 SP1) is vulnerable due to use of a weak password-hashing algorithm for device user passwords stored in TIA Portal project files. Local users with read access to a project file could potentially reconstruct plaintext passwords. Siemens r...

CVE-2015-1355

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack...

CVE-2015-1356

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file...

CVE-2015-1355: Undefined Security Weakness

Siemens SIMATIC STEP 7 TIA Portal before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack...