Design/Logic Flaw

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2014-1699

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 uses a weak password hash in the server application, enabling remote brute-force access. Affected: SIMATIC WinCC OA server (prior to 3.12 P002 January). Impact: potential privilege escalation or unauthorized access as described in the ICS advisory. Remedi...

CVE-2014-1698

CVE-2014-1698 is a directory traversal vulnerability in Siemens SIMATIC WinCC OA, affecting versions before 3.12 P002 January. The affected component is the integrated Web server at Port 4999/TCP, allowing remote attackers to read arbitrary files via crafted packets. The ICS advisory confirms mul...

CVE-2014-1697

The CVE-2014-1697 entry concerns Siemens SIMATIC WinCC OA prior to version 3.12 P002. The vulnerability lies in the integrated Web server on port 4999, where specially crafted, unauthenticated packets can remotely trigger arbitrary code execution due to improper handling of inputs (code injection...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2014-1699

CVE-2014-1699 affects Siemens SIMATIC WinCC OA before version 3.12 P002 January. The vulnerability resides in the integrated Web server on port 4999/TCP and stems from improper input validation, allowing remote attackers to trigger a denial of service (monitoring-service outage) by sending malfor...

CVE-2014-1697

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1698

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

Siemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-105-03A Siemens Industrial Products OpenSSL Heartbleed Vulnerability that was published April 29, 2014, on the NCCIC/ICS-CERT web site. Siemens reported to ICS-CERT a list of products affected by the OpenSSL...

USB Malware Targeting Siemens Control Software (Update C)

Overview VirusBlokAda, an antivirus vendor based in Belarus, announcedVirusBlokAda, http://www.anti-virus.by/en/tempo.shtml, website last visited July 15, 2010. the discovery of malware that uses a zero-day vulnerability in Microsoft Windows processing of shortcut files. The malware utilizes this...

PT-2014-14: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. The database server of SIMATIC WinCC could allow authenticated users to escalate their privileges in the database if a specially crafted command is sent to the database server at port...

Siemens WinCC 7.0 SP3 Multiple Vulnerabilities

Overview This advisory provides mitigation details for vulnerabilities that impact the Siemens SIMATIC WinCC. Positive Technologies and Siemens ProductCERT have identified multiple vulnerabilities in the Siemens SIMATIC WinCC, which is used to configure SIMATIC operator devices. Siemens has...

Siemens WinCC TIA Portal Vulnerabilities

Overview This advisory provides mitigation details for a vulnerability that impacts the Siemens WinCC TIA Totally Integrated Automation Portal HMI. Researchers Billy Rios and Terry McCorkle of Cylance; Gleb Gritsai, Sergey Bobrov, Roman Ilin, Artem Chaykin, Timur Yunusov, and Ilya Karpov from...

PT-2013-78: Buffer overflow in SIMATIC WinCC Open Architecture

The specialists of the Positive Research center have detected a Buffer overflow vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to perform remote code execution by sending specially crafted packets without...

PT-2013-80: Improper input validation in SIMATIC WinCC Open Architecture

The specialists of the Positive Research center have detected an Improper input validation vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to perform a denial of service attack on the SIMATIC WinCC OA monitoring...

PT-2013-79: Relative path traversal in SIMATIC WinCC Open Architecture

The specialists of the Positive Research center have detected a Relative path traversal vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to traverse through the server’s file system based on the application’s Windo...

Siemens Simatic SCADA WINCC SQL Insecure Default Credentials Security Bypass (CVE-2010-2772)

A security bypass vulnerability has been reported in Siemens SIMATIC WinCC server. A remote attacker can exploit this issue by using the default hard-coded password to bypass certain security restrictions and gain access to the application's database...

Siemens WinCC Exploitable Crashes

Overview ICS-CERT Advisory ICSA-11-175-02P was originally released to the US-CERT Portal on June 24, 2011. This web page release was delayed to allow users sufficient time to download and install the update. ICS-CERT has received a report from independent security researchers Billy Rios and Terry...

CVE-2013-4912

Open redirect vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...