ICSA-14-035-01

icsaUScisa_csaf_ot

Siemens SIMATIC WinCC OA Multiple Vulnerabilities

view advisory published 2014-11-07

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

01

describes (4)

Related CVEs.

IDseverity exploitable
CVE-2014-1699USmedium5.0—
Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999.
CVE-2014-1698USmedium5.0—
Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.
CVE-2014-1697UShigh7.5OT elevated—
The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.
CVE-2014-1696USmedium5.0—
Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack.
02

references

External citations — patches, advisories, analysis.

03

remediations (4)

  • MitigationSIMATIC WinCC OA

    Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January

  • MitigationSIMATIC WinCC OA

    Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January

  • MitigationSIMATIC WinCC OA

    Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January

  • MitigationSIMATIC WinCC OA

    Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan