CVE-2014-2908

CVE-2014-2908 describes a cross-site scripting (XSS) vulnerability in the integrated web server of Siemens SIMATIC S7-1200 CPU devices (2.x and 3.x). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially executing script in the affected user...

CVE-2014-2256

CVE-2014-2256 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware before 4.0. The vulnerability is due to improper input validation in the device’s handling of packets, enabling a remote attacker to trigger a defect-mode transition and cause a denial of service via crafted ISO-TSAP packets. De...

CVE-2014-2909

CVE-2014-2909 describes a CRLF injection vulnerability in the integrated web server of Siemens SIMATIC S7-1200 CPU family (versions 2.x and 3.x) that could enable HTTP header injection. The issue is categorized as an HTTP response splitting risk with a CVSS v2 base score of 5.8 (network access, m...

CVE-2014-2258

CVE-2014-2258 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware before 4.0. A crafted HTTPS packet can trigger a defect-mode transition, causing a denial of service. The issue is distinct from CVE-2014-2259. The vulnerability is triggered via remote network access to the device’s HTTPS handl...

CVE-2014-2254

CVE-2014-2254 affects Siemens SIMATIC S7-1200 CPU PLCs with firmware prior to 4.0. The vulnerability allows remote DoS (defect-mode transition) by sending crafted HTTP packets to the device’s web server (Port 80/443). Root cause is related to improper handling within the device’s HTTP interface, ...

CVE-2014-2250

CVE-2014-2250 concerns Siemens SIMATIC S7-1200 CPUs with firmware before 4.0, where the PRNG has insufficient entropy. This weaknesses can enable remote attackers to defeat cryptographic protections and hijack sessions via unspecified vectors. Public material ties this to the S7-1200 family and n...

CVE-2014-2252

Summary (CVE-2014-2252) : Siemens SIMATIC S7-1200 CPU PLC devices with firmware prior to 4.0 are affected by a vulnerability that allows remote attackers to cause a denial of service (defect-mode transition) by sending crafted PROFINET packets. The issue is tied to improper handling that enables ...