SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2
SIMATIC S7-1200 CPU V2 devices contain an insufficiently protected private key used for the Certificate Authority (CA) for HTTPS connections. Possession of this key could allow remote attackers to spoof the device's web server by creating a forged web server certificate. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. Refer to the chapter Additional Information for more details.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-3037US | medium4.3OT erhöht | — | ||
The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)
Uninstall the affected CA keys from the browser's certificate store.
- Kein Fix geplantSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)
Currently no fix is planned
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan