PT-2015-3791

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC Sm@rtClient app version 1.0.1 and earlier Description The issue allows physically proximate attackers to discover Sm@rtServer credentials due to an error in the credential-processing mechanism. Recommendations For version...

PT-2015-3790

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC Sm@rtClient app versions prior to 1.0.2 Description The issue allows local users to bypass an intended application-password requirement. This is achieved by leveraging the running of the app in the background state...

CVE-2014-5231: Exposure of Sensitive Information to an Unauthorized Actor

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors...

CVE-2014-5232: Undefined Security Weakness

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows local users to bypass an intended application-password requirement by leveraging the running of the app in the background state...

CVE-2014-5233: Exposure of Sensitive Information to an Unauthorized Actor

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism...

Industrial safety: BlackEnergy（dark）the use of the Siemens WinCC system has been repaired loopholes to launch attacks-vulnerability warning-the black bar safety net

Researchers recently found that the malware BlackEnergy（dark forces are using Siemens SIMATIC WinCC（Siemens the most classic process monitoring system has been repaired loopholes to re-attack the SCADA HMI system. ! Comeback: the BlackEnergy then update the BlackEnergy（dark）is an automated networ...

Black Energy Malware May Be Exploiting Patched WinCC Flaw

Experts at ICS-CERT say that the BlackEnergy malware that has been seen infecting human-machine interface systems may be exploiting a recently patched vulnerability in the Siemens SIMATIC WinCC software in order to compromise some systems. The ICS-CERT originally issued an alert about the attacks...

Elipse SCADA Denial of Service Patch

Brazilian process management software developer Elipse has patched a serious denial-of-service vulnerability in its web-based Elipse SCADA application. The software is used in a number of critical industries worldwide, including manufacturing, energy, water and wastewater plants. The vulnerabilit...

CVE-2014-8552

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets...

Code injection

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets...

Code injection

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets...

CVE-2014-8551

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets...

CVE-2014-8551

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets...

CVE-2014-8552

CVE-2014-8552 : The WinCC family (SIMATIC WinCC 7.0 SP3 and earlier, 7.2 before Update 9, 7.3 before Update 2; PCS 7 7.1 SP4 and earlier, 8.0 before SP2 with WinCC 7.2 Update 9, 8.1 before Update 2; TIA Portal 13 before Update 6) contains an unauthenticated remote arbitrary-file-read vulnerabilit...

CVE-2014-8551

CVE-2014-8551 describes a remote code execution vulnerability in Siemens WinCC/PCS7/TIA Portal components due to improper access control (CWE-284). A component within WinCC could allow unauthenticated remote code execution when specially crafted packets are sent to the WinCC server. Affected prod...

CVE-2014-8552

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets...

Siemens Patches WinCC Vulnerabilities Likely Being Exploited

Global industrial supplier Siemens has patched two critical vulnerabilities that it believes are likely being exploited. Organizations running products using the Siemens WinCC application are urged to apply available patches immediately; the company said it is working on updates for any remaining...

PT-2014-8613

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions 7.0 through 7.0 SP3 Siemens SIMATIC WinCC versions 7.2 through 7.2 before Update 9 Siemens SIMATIC WinCC versions 7.3 through 7.3 before Update 2 Siemens SIMATIC PCS 7 versions 7.1 through 7.1 SP4 Siemens SIMATIC...

CVE-2014-8551: Improper Control of Generation of Code

The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets...

PT-2014-8612

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions 7.0 through 7.3 before Update 2 Siemens SIMATIC PCS 7 versions 7.1 through 8.1 Siemens TIA Portal version 13 before Update 6 Description The issue allows remote attackers to execute arbitrary code via crafted...