Siemens S7-1200 Insecure Storage of HTTPS CA Certificate
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-3037US | medium4.3OT elevated | — | ||
The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-12-263-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-12-263-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (1)
- MitigationSIMATIC S7-1200
Siemens strongly recommends the user uninstall the CA signing keys from the Web browser’s certificate store. The procedure for performing this task is specific to each browser. Once this is performed, warning messages will occur when attempting to connect to an S7-1200 PLC. The user can manually confirm the identity of the PLC and accept its certificate via the browser. This has to be done once for each S7-1200 PLC on the network.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan