SSA-279823: Cross-Site Scripting Vulnerability in SIMATIC S7-1200 CPU V2/V3 Before V3.0.2
The web server on SIMATIC S7-1200 CPU V2/V3 Before V3.0.2 contains a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via a crafted URI. Siemens has released a new version for SIMATIC S7-1200 CPU V3 family (incl. SIPLUS variants) and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-3040US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a cr… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- MitigationSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
- MitigationSIMATIC S7-1200 CPU V3 family (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
- Kein Fix geplantSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)
Currently no fix is planned
- BehobenSIMATIC S7-1200 CPU V3 family (incl. SIPLUS variants)
Update to V3.0.2 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan