Siemens S7-1200 Insecure Storage of HTTPS CA Certificate
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-3037US | medium4.3OT erhöht | — | ||
The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-12-263-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-12-263-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (1)
- MitigationSIMATIC S7-1200
Siemens strongly recommends the user uninstall the CA signing keys from the Web browser’s certificate store. The procedure for performing this task is specific to each browser. Once this is performed, warning messages will occur when attempting to connect to an S7-1200 PLC. The user can manually confirm the identity of the PLC and accept its certificate via the browser. This has to be done once for each S7-1200 PLC on the network.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan