SSA-279823: Cross-Site Scripting Vulnerability in SIMATIC S7-1200 CPU V2/V3 Before V3.0.2
The web server on SIMATIC S7-1200 CPU V2/V3 Before V3.0.2 contains a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via a crafted URI. Siemens has released a new version for SIMATIC S7-1200 CPU V3 family (incl. SIPLUS variants) and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-3040US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a cr… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- MitigationSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
- MitigationSIMATIC S7-1200 CPU V3 family (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
- No fix plannedSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)
Currently no fix is planned
- FixedSIMATIC S7-1200 CPU V3 family (incl. SIPLUS variants)
Update to V3.0.2 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan