833 matches found
Siemens Patches Five Vulnerabilities in SIMATIC WinCC for PCS 7
Siemens has patched five vulnerabilities in its SIMATIC PCS 7 system that could result in privilege escalation and give an attacker unauthenticated access to sensitive data. The flaws technically exist in WinCC, a SCADA supervisory control and data acquisition and HMI human-machine interface syst...
Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities
OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-329-02C Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities that was published December 18, 2014, on the NCCIC/ICS-CERT web site. Siemens has identified two vulnerabilities within products using the Sieme...
Siemens Patches DoS Vulnerability in SIMATIC S7
Siemens released an update for one of its automation systems late last week, patching a denial of service vulnerability in all versions of its SIMATIC S7-1500 CPU prior to V1.6. An advisory on the Industrial Control Systems Cyber Emergency Response Team’s ICS-CERT website warned about the...
Siemens Patches Five Vulnerabilities in SIMATIC System
Siemens released an update for two builds of its SIMATIC automation system this week, addressing a quintet of vulnerabilities, four of which are remotely exploitable. The German company’s SIMATIC WinCC, a SCADA system and SIMATIC PCS7, a distributed control system DCS are directly affected by the...
CVE-2014-4685
Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveraging weak system-object access control...
CVE-2014-4684
The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a request to TCP port 1433...
CVE-2014-4686
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during...
CVE-2014-4682
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request...
Cross site request forgery (csrf)
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a 1 HTTP or 2 HTTPS request...
Improper access control
Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows local users to gain privileges by leveraging weak system-object access control...
Cross site request forgery (csrf)
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote attackers to obtain sensitive information via an HTTP request...
Design/Logic Flaw
The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a request to TCP port 1433...
Hardcoded credentials
The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during...
CVE-2014-4684
The database server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a request to TCP port 1433...
CVE-2014-4683
The WebNavigator server in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, allows remote authenticated users to gain privileges via a 1 HTTP or 2 HTTPS request...
CVE-2014-4684
The CVE-2014-4684 issue affects Siemens SIMATIC WinCC before 7.3 (as used in PCS7 and other products) where the WinCC database server could allow remote authenticated users to escalate privileges by sending a crafted command to TCP/1433. Connected sources confirm root cause in the database server...
CVE-2014-4686
Siemens SIMATIC WinCC (before 7.3) contains a hard-coded encryption key in the Project administration component, enabling remote attackers to extract the key from another installation and use it to sniff traffic on TCP port 1030. This can lead to credential exposure and elevated privileges. Publi...
CVE-2014-4683
The CVE-2014-4683 issue affects Siemens SIMATIC WinCC WebNavigator: remote authenticated users can escalate privileges via HTTP/HTTPS requests to the WebNavigator server (ports 80/443). Sources describe Prague: Privilege gain through WebNavigator’s access control, with explicit remediation in upd...