CVE-2013-0674

Siemens WinCC RegReader ActiveX Control vulnerability (CVE-2013-0674) affects WinCC prior to 7.2 and SIMATIC PCS7 prior to 8.0 SP1. A stack-based buffer overflow in RegReader can be triggered via a long parameter in the ActiveX control, potentially allowing remote code execution in the user’s bro...

CVE-2017-12069

Summary: CVE-2017-12069 is an XXE vulnerability in the OPC UA Discovery Server handling of XML, affecting Siemens products using the OPC UA Stack (e.g., SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, SIMATIC NET PC Software, and IT Production Suite). Root cause: Improper restri...

CVE-2011-4509

CVE-2011-4509 affects Siemens WinCC/WinCC flexible products (2004–2008, WinCC V11, and related SIMATIC HMI panels). The root cause is an improperly selected default administrator password, which enables remote attackers to gain access by brute-forcing via many HTTP requests. Public citations in c...

CVE-2014-4684

The CVE-2014-4684 issue affects Siemens SIMATIC WinCC before 7.3 (as used in PCS7 and other products) where the WinCC database server could allow remote authenticated users to escalate privileges by sending a crafted command to TCP/1433. Connected sources confirm root cause in the database server...

CVE-2015-1358

Siemens SIMATIC WinCC (TIA Portal) CVE-2015-1358: The remote-management modules in WinCC (TIA Portal) Multi Panels, Comfort Panels and RT Advanced, and in WinCC Flexible panels/runtime before the stated SPs, transmit credentials in weak or unencrypted form. This allows network-sniffing attackers ...

CVE-2015-2823

CVE-2015-2823 affects Siemens SIMATIC HMI/WinCC products (HMI Basic Panels 2nd Gen and others) where an attacker can authenticate remotely by using a password hash instead of the password. The issue is a password-hash authentication weakness that can enable unauthorized access to multiple SAP/Win...

CVE-2011-4508

CVE-2011-4508: Insecure, predictable authentication token generation in Siemens WinCC/HMI web servers (WinCC flexible 2004–2008 before SP3; WinCC V11 before SP2 Update 1; and related HMI panels) allows remote attackers to bypass authentication by crafting cookies. Affected components include HMI ...

CVE-2013-0676

Siemens WinCC (before 7.2; in SIMATIC PCS7 before 8.0 SP1) stores WebNavigator credentials in an MS SQL database and fails to properly restrict privileges. This Improper Authorization allows remote authenticated users to read sensitive data via SQL queries. Impact includes exposure of credentials...

CVE-2013-3959

The CVE-2013-3959 issue affects Siemens WinCC Web Navigator (before 7.2 Update 1, used in SIMATIC PCS7 8.0 SP1 and earlier). The root cause is improper handling of NetBIOS user name checks via crafted URL parameters, allowing remote authenticated users to enumerate valid user names (forced browsi...

CVE-2015-2822

The CVE-2015-2822 issue concerns Siemens SIMATIC HMI/WinCC components vulnerable to remote man-in-the-middle and potential denial-of-service on port 102/TCP. Connected sources specify affected product families and versions, including SIMATIC HMI Comfort Panels and SIMATIC WinCC Runtime Advanced (...

CVE-2012-3032

CVE-2012-3032 describes a SQL Injection vulnerability in the WebNavigator component of Siemens WinCC (7.0 SP3 and earlier) where a crafted SOAP message can cause arbitrary SQL commands to be executed. The affected product is Siemens WinCC WebNavigator; the root cause is improper neutralization of...

CVE-2014-4685

CVE-2014-4685 affects Siemens SIMATIC WinCC prior to 7.3 (used in PCS7). Root cause: weak system-object access control enabling local privilege escalation for local users. Siemens released fixes in WinCC 7.3 (and PCS7 8.1); upgrading is advised. Other sources note mitigation steps and a broader s...

CVE-2011-4875

CVE-2011-4875 corresponds to a stack-based buffer overflow in the HmiLoad runtime loader of Siemens WinCC flexible (versions 2004, 2005, 2007, 2008) and WinCC V11 (TIA Portal) including SIMATIC HMI panels and WinCC V11 Runtime Advanced. The root cause is improper handling/validation of Unicode st...

CVE-2013-3957

CVE-2013-3957 describes an SQL injection vulnerability in the Web Navigator login screen of Siemens WinCC prior to version 7.2 Update 1 (used in SIMATIC PCS7 8.0 SP1 and earlier). The issue arises from input handling in the login/UI that can be manipulated to inject SQL statements through unspeci...

CVE-2014-4682

CVE-2014-4682 pertains to the WebNavigator server in Siemens SIMATIC WinCC (pre-7.3). Multiple sources describe that the WebNavigator at ports 80/443 could allow unauthenticated remote access to sensitive data via specially crafted HTTP requests, with a CVSSv2 base score of 5.0. The broader Sieme...

CVE-2014-4686

Siemens SIMATIC WinCC (before 7.3) contains a hard-coded encryption key in the Project administration component, enabling remote attackers to extract the key from another installation and use it to sniff traffic on TCP port 1030. This can lead to credential exposure and elevated privileges. Publi...

CVE-2011-4876

CVE-2011-4876 is a directory traversal vulnerability in Siemens WinCC family runtimes (WinCC flexible 2004–2008, WinCC V11/TIA Portal, and related SIMATIC HMI panels) where the runtime loader HmiLoad fails to validate strings during Transfer Mode. This allows remote attackers to access or modify ...

CVE-2012-3034

The CVE-2012-3034 issue affects Siemens WinCC WebNavigator (used with SIMATIC PCS7) where crafted parameters to certain ActiveX controls allow remote attackers to obtain a user name and password. The root cause involves unsafe handling within ActiveX methods exposed by WebNavigator, enabling cred...

CVE-2011-4511

CVE-2011-4511 is a cross-site scripting (XSS) vulnerability in the Siemens SIMATIC WinCC HMI web server. Affected products (per ICS-CERT) include WinCC flexible 2004/2005/2007/2008 (before SP3), WinCC V11 (TIA Portal) before SP2 Update 1, and multiple SIMATIC HMI panels plus WinCC V11 Runtime Adv...

CVE-2013-0678

Siemens WinCC (before 7.2, used in SIMATIC PCS7 before 8.0 SP1) stores WebNavigator passwords in an MS SQL database without proper protection, enabling remote authenticated users with DB access to read credentials and obtain sensitive information. The root cause is information disclosure due to m...

CVE-2013-3958

CVE-2013-3958 affects Siemens WinCC Web Navigator (7.2 and earlier, used with SIMATIC PCS7 8.0 SP1 and related products). The root cause is hard-coded credentials in the Web Navigator login system, enabling remote attackers with network access to log in as an authenticated user and potentially ex...

CVE-2023-30897

Siemens SIMATIC WinCC vulnerability CVE-2023-30897 affects all versions prior to V7.5.2.13. The issue is an incorrect permission assignment for the installation folder when a non-default installation path is used, which could allow an authenticated local attacker to inject arbitrary code and esca...

CVE-2012-3028

CVE-2012-3028 affects Siemens WinCC WebNavigator (7.0 SP3 and earlier). A CSRF flaw lets remote attackers hijack a user’s session to perform data-modifying actions or cause a denial of service. Mitigation: Siemens released SSA-864051 and an update for WinCC 7.0 SP3; apply the patch and limit expo...

CVE-2012-3031

CVE-2012-3031 affects Siemens WinCC WebNavigator (Web interface for WinCC) in WinCC 7.0 SP3 and earlier. The vulnerability is reflected XSS (via a GET parameter, a POST parameter, or the Referer header) that could let an attacker inject arbitrary script/HTML. ICS-CERT notes the issues could allow...

CVE-2012-2596

The CVE-2012-2596 vulnerability affects Siemens WinCC 7.0 SP3 web applications, where the XPath/XML injection occurs because URL parameters do not properly filter special characters. This allows remote authenticated users to read or modify settings via a crafted URL. The issue is mitigated by app...

CVE-2013-0675

CVE-2013-0675 describes a remote buffer overflow in the CCEServer (central communications component) of Siemens WinCC prior to version 7.2, used in SIMATIC PCS7 prior to 8.0 SP1. A crafted packet to a dynamically assigned port can trigger a DoS condition on WinCC. Affected software is WinCC with ...

CVE-2011-4879

Siemens WinCC/HMI Web Server vulnerability CVE-2011-4879: the HMI web server (miniweb.exe) fails to properly handle URIs beginning with 0xfa, enabling remote memory reads or DoS via crafted POST requests. Affected products include WinCC flexible 2004–2008 (pre-SP3), WinCC V11 (TIA Portal) before ...

CVE-2013-0679

CVE-2013-0679 concerns Siemens WinCC Web Server: a Relative Path Traversal vulnerability that allows remote authenticated users to read arbitrary files by crafting a URL pathname. Affected products include WinCC prior to 7.2 (and SIMATIC PCS7 prior to 8.0 SP1); the issue arises in the Web server ...

CVE-2014-4683

The CVE-2014-4683 issue affects Siemens SIMATIC WinCC WebNavigator: remote authenticated users can escalate privileges via HTTP/HTTPS requests to the WebNavigator server (ports 80/443). Sources describe Prague: Privilege gain through WebNavigator’s access control, with explicit remediation in upd...

CVE-2011-4510

CVE-2011-4510 and CVE-2011-4511 describe cross-site scripting (XSS) in the Siemens SIMATIC WinCC/HMI Web server. Affected products include WinCC flexible 2004–2008 (before SP3), WinCC V11 (TIA Portal) before SP2 Update 1, and multiple SIMATIC HMI panels, plus WinCC V11 Runtime Advanced and WinCC ...

CVE-2011-4513

CVE-2011-4513 affects Siemens WinCC Flexible (2004–2008), WinCC V11 (TIA Portal), SIMATIC HMI panels (TP/OP/MP/Comfort/Mobile), and WinCC Runtime Advanced/Flexible Runtime. The vulnerability allows user-assisted remote attackers to execute arbitrary code via a crafted project file, related to the...

CVE-2011-4514

CVE-2011-4514 concerns the TELNET daemon in Siemens WinCC flexible (2004–2008) and WinCC V11 (TIA Portal), plus related SIMATIC HMI panels, which does not perform authentication, enabling remote access via TCP sessions. Affected products include WinCC flexible 2004/2005/2007/2008, WinCC V11, TP/O...

CVE-2011-4877

CVE-2011-4877 affects Siemens WinCC flexible products (2004–2008) and related SIMATIC HMI panels, WinCC V11 Runtime Advanced, and WinCC flexible Runtime. The issue lies in HmiLoad in the runtime loader; when Transfer Mode is enabled, sending crafted data over TCP can cause a remote denial of serv...

CVE-2012-3003

CVE-2012-3003 is an open-redirect vulnerability in Siemens WinCC 7.0 SP3 before Update 2. The issue affects the WinCC web server/web applications and can allow remote attackers to redirect users to arbitrary sites via a URL parameter in a GET request. According to CVSS data, the access vector is ...

CVE-2011-4512

CVE-2011-4512 is a CRLF/header-injection vulnerability in the Siemens SIMATIC WinCC/HMI web server. Affected products include WinCC flexible 2004/2005/2007/2008 before SP3; WinCC V11 (TIA Portal) before SP2 Update 1; multiple SIMATIC HMI panels (TP/OP/MP/Comfort/Mobile); WinCC V11 Runtime Advance...

CVE-2011-4878

Siemens WinCC/HMI Web Server is vulnerable to a directory traversal in the HMI web server component (miniweb.exe) affecting WinCC flexible 2004–2008, WinCC V11 (TIA Portal) before SP2 Update 1, and related SIMATIC HMI panels and runtimes. Root cause: improper validation of HTTP/URI strings allows...

CVE-2013-4912

The CVE-2013-4912 issue concerns Siemens WinCC (TIA Portal) Web Server in WinCC V11/V12 (pre-SP1). The vulnerability is an Open Redirect in the Web server, caused by improper configuration of SIMATIC HMI panels, allowing remote attackers to redirect users to arbitrary sites and potentially enable...

CVE-2012-2595

CVE-2012-2595 covers multiple reflected XSS vulnerabilities in Siemens WinCC 7.0 SP3 web applications prior to Update 2. The root cause is that web applications do not filter out special characters in URL parameters, enabling remote attackers to inject arbitrary script/HTML. The CVE is documented...

CVE-2012-2598

The CVE-2012-2598 issue affects Siemens WinCC 7.0 SP3 (DiagAgent Web server). A buffer overflow in the DiagAgent Web server can be triggered by crafted input, allowing remote attackers to cause a denial of service (agent outage). The vulnerability is remotely exploitable over the network with no ...

CVE-2012-3030

Siemens WinCC WebNavigator (WebNavigator component) in WinCC 7.0 SP3 and earlier stores sensitive files under the web root with insufficient access controls, enabling a remote attacker to read (1) a log file or (2) a configuration file via a direct request. The issue is mapped to CVE-2012-3030 an...

CVE-2013-0677

The CVE-2013-0677 issue affects Siemens WinCC (pre-7.2) used in SIMATIC PCS7 pre-8.0 SP1 and related products. A crafted project file can allow remote attackers to access sensitive information or cause a DoS via the WinCC web server component. The root cause is improper handling of crafted projec...

CVE-2013-4911

CVE-2013-4911 concerns a Cross-Site Request Forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal). Affected products are WinCC (TIA Portal) V11 and V12 prior to SP1 of V12. The root cause is improper configuration of SIMATIC HMI panels in the WinCC product, enabling an attacker to hijack a v...

CVE-2012-2597

Siemens WinCC 7.0 SP3 contains a directory traversal flaw (CVE-2012-2597) that allows remote AUTHENTICATED users to read arbitrary files via a crafted URL parameter. Affected: WinCC Web applications on 7.0 SP3 before Update 2. Root cause: improper handling of URL parameters leading to path traver...