Siemens Synco OZW Default Password
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-3020US | high7.5 | — | ||
The Siemens Synco OZW Web Server devices OZW672.*, OZW772.*, and OZW775 with firmware before 4 have an unspecified default password, which makes it easier for remote attackers to o… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-12-214-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-12-214-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (1)
- MitigationSynco models
Siemens has released a firmware update (Version 4) and security advisory SSA-283911 (https://cert-portal.siemens.com/productcert/pdf/ssa-283911.pdf) for the OZW672 and OZW772 devices that enforces a password change at initial login. (http://support.automation.siemens.com/WW/view/en/41929231/130000) Users may upgrade to this firmware version, but this is not required to change the default password on existing devices. Siemens urges customers to set a secure password on the web interface for all network devices.
http://support.automation.siemens.com/WW/view/en/41929231/130000
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan