CVE-2014-2250

CVE-2014-2250 concerns Siemens SIMATIC S7-1200 CPUs with firmware before 4.0, where the PRNG has insufficient entropy. This weaknesses can enable remote attackers to defeat cryptographic protections and hijack sessions via unspecified vectors. Public material ties this to the S7-1200 family and n...

CVE-2014-2250: Undefined Security Weakness

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

CVE-2014-2256: Undefined Security Weakness

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted ISO-TSAP packets, a different vulnerability than CVE-2014-2257...

CVE-2014-2254: Undefined Security Weakness

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTP packets, a different vulnerability than CVE-2014-2255...

CVE-2014-2252: Undefined Security Weakness

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted PROFINET packets, a different vulnerability than CVE-2014-2253...

CVE-2014-2258: Undefined Security Weakness

Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTPS packets, a different vulnerability than CVE-2014-2259...

Siemens SIMATIC S7-1200多个漏洞

CVE ID: CVE-2014-2249,CVE-2014-2250,CVE-2014-2252,CVE-2014-2254,CVE-2014-2256,CVE-2014-2258 SIMATIC S7-1200是可编程控制器，可实现简单却高度精确的自动化任务。 Siemens SIMATIC S7-1200 4.0.0之前版本在实现上存在多个漏洞，可被恶意利用执行跨站请求伪造、劫持用户会话、造成拒绝服务。 1、向TCP端口443发送特制的数据包造成的错误可造成设备进入defect模式。 2、随机生成器内弱熵相关错误，可导致劫持另外用户的会话。...

PT-2014-15: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. Access permissions on system objects could allow a local user to obtain limited escalated privileges within the operating system. How to fix Update your software up to the latest...

CVE-2014-2246

Cross-site scripting XSS vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors...

Open redirect

Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2014-2248

Open Redirect vulnerability CVE-2014-2248 affects Siemens SIMATIC S7-1500 CPU PLCs with web server (ports 80/443). Root cause: open redirect in the integrated web server, enabling remote attackers to redirect users to untrusted sites and facilitate phishing. Affects firmware older than 1.5.0; mit...

CVE-2014-2246

CVE-2014-2246 is an XSS vulnerability in the integrated web server of Siemens SIMATIC S7-1500 CPU PLCs with firmware older than 1.5.0 . The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The affected component is the web server running on the PLC dev...

CVE-2014-2253

CVE-2014-2253 affects Siemens SIMATIC S7-1500 CPU PLCs with firmware before 1.5.0. The vulnerability allows remote attackers to cause a denial of service (defect‑mode transition) by sending crafted Profinet packets. Public details in the connected docs confirm the affected product family, the att...

CVE-2014-2255

Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service defect-mode transition via crafted HTTP packets...

CVE-2014-2248

Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2014-2249

CVE-2014-2249 is a CSRF vulnerability in Siemens SIMATIC S7-1500 (< v1.5) and S7-1200 (

CVE-2014-2251

Siemens SIMATIC S7-1500 CPUs with firmware

CVE-2014-2247

This CVE affects Siemens SIMATIC S7-1500 CPU PLCs with firmware = 1.5.0 and apply network segmentation and access controls to reduce exposure.

CVE-2014-2257: Undefined Security Weakness

Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allow remote attackers to cause a denial of service defect-mode transition via crafted ISO-TSAP packets...