CVE-2013-0671: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Siemens WinCC TIA Portal 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL...

CVE-2011-4515: Undefined Security Weakness

Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...

CVE-2013-0672: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data...

CVE-2013-0668: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the HMI web application in Siemens WinCC TIA Portal 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-0667: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-0669: Improper Input Validation

The HMI web application in Siemens WinCC TIA Portal 11 allows remote authenticated users to cause a denial of service daemon crash via a crafted HTTP request...

PT-2013-2513

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the HMI web application. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a crafted...

PT-2013-1037

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions prior to 7.3 Description The issue allows a local user to gain limited elevated privileges of the operating system user by leveraging weak system-object access control. This could potentially be exploited to gain...

PT-2013-43: Hard-coded credentials in Siemens WinCC and SIMATIC PCS 7

The specialists of the Positive Research center have detected a vulnerability in Siemens WinCC and SIMATIC PCS 7 related to hard-coded credentials used in the login system . Attackers with network access and knowledge of the credentials could log into the Web Navigator Web applications as an...

Simatic WinCC Information Harvester

encoding: UTF-8 This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Simatic WinCC info...

PT-2013-42: SQL Injection in Siemens WinCC and SIMATIC PCS 7

The specialists of the Positive Research center have detected "SQL Injection" vulnerability in Siemens WinCC and SIMATIC PCS 7. The WinCC Web Navigator 7.2 and Runtime Client OPC protocol have input filtering in the login screen an attacker can overcome, allowing injection of SQL statements into...

PT-2013-44: Forced browsing in Siemens WinCC and SIMATIC PCS 7

The specialists of the Positive Research center have detected a vulnerability, which can be used to gain access to usernames in Siemens WinCC and SIMATIC PCS 7. The WinCC Web Navigator 7.2 allows a user with authenticated access to probe for valid NetBIOS user names by manipulating URL parameters...

PT-2012-1016

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions prior to 7.3 Description The issue is related to an error that occurs when processing a specially crafted HTTP packet, allowing an unauthenticated attacker to gain access to confidential information by sending a...

PT-2014-13: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. Existing access control of the WinCC WebNavigator server at port 80/tcp and port 443/tcp could allow remote authenticated users to escalate their privileges in WinCC. How to fix Updat...

PT-2014-12: Information Disclosure in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected an Information disclosure vulnerability in SIMATIC WinCC. The SIMATIC WinCC WebNavigator server at port 80/tcp and port 443/tcp could allow unauthenticated access to sensitive data if an attacker sends specially crafted HTTP requests t...

PT-2012-1017

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions prior to 7.3 Description The issue allows remote authenticated users to gain privileges. This can be achieved via an HTTP or HTTPS request. The vulnerability is related to errors in the code of the WinCC...

Kelihos Update Includes New TLD and USB Infection Capabilities

There’s a little Michael Myers in the Kelihos botnet; maim it, kill it and it keeps on coming back to wreak more havoc. The 2011 takedown of the Kelihos botnet was one of Microsoft’s high-profile success stories against spambots and the like, yet Kelihos was back for more at the start of 2012 usi...

Siemens SIMATIC WinCC Vulnerabilities

Overview This advisory is a follow-up to a previous advisory titled “ICSA-11-356-01 – Siemens HMI Authentication Vulnerabilities” that was published December 22, 2011, and an alert titled "ICS-ALERT-11-332-02A – Siemens SIMATIC WinCC Flexible Vulnerabilities" that was published December 2, 2011...

PT-2013-34: Cross-Site Scripting in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Cross-Site Scripting" vulnerability in Siemens Simatic WinCC TIA Portal. If a user clicks on a malicious link which seems to lead to a HMI web application, it is possible to display any data to the user server-side script injection. H...

PT-2013-35: Cross-Site Scripting in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Cross-Site Scripting" vulnerability in Siemens Simatic WinCC TIA Portal. The HMI’s web application is susceptible to reflected Cross-Site-Scripting attacks. If a legitimate user clicks on a malicious link, JavaScript code may get...