ICSA-14-035-01

Siemens SIMATIC WinCC OA Multiple Vulnerabilities

Advisory ansehen veröffentlicht 2014-11-07

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

beschreibt (4)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2014-1699US	medium5.0	2.14% (82nd)	—	2014-02-07
Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service (monitoring-service outage) via malformed HTTP requests to port 4999.
CVE-2014-1698US	medium5.0	3.51% (89th)	—	2014-02-07
Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999.
CVE-2014-1697US	high7.5OT erhöht	5.26% (93rd)	—	2014-02-07
The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999.
CVE-2014-1696US	medium5.0	1.69% (77th)	—	2014-02-07
Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack.

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

ICS Advisory ICSA-14-035-01 JSONself
Recommended Practicesexternal
ICS Advisory ICSA-14-035-01 - Web Versionself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal

Behebungen (4)

MitigationSIMATIC WinCC OA
Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January
MitigationSIMATIC WinCC OA
Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January
MitigationSIMATIC WinCC OA
Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January
MitigationSIMATIC WinCC OA
Siemens recommends updating to SIMATIC WinCC OA v3.12 and to install patch P002 January

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan