CVE-2012-3037

mediumPriorität · verfolgen · 18OT-Risiko · erhöhtEPSS 0.015 · 74. PerzentilDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.47% (74th) EPSS
CVSS 4.3 · medium
Is it mine?
14 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-28

The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

  • MitigationSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)siemens_psirt

    Uninstall the affected CA keys from the browser's certificate store.

  • MitigationSIMATIC S7-1200cisa_csaf_ot

    Siemens strongly recommends the user uninstall the CA signing keys from the Web browser’s certificate store. The procedure for performing this task is specific to each browser. Once this is performed, warning messages will occur when attempting to connect to an S7-1200 PLC. The user can manually confirm the identity of the PLC and accept its certificate via the browser. This has to be done once for each S7-1200 PLC on the network.

  • Kein Fix geplantSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–critical · 3.7–9.3

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9
v2.09.3criticalAV:N/AC:M/Au:N/C:C/I:C/A:Csecondary · CISA US
v2.03.7lowAV:N/AC:M/Au:N/C:P/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.3highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Siemens ProductCERT DE
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-295USprimärCWE-295USCWE-311USCWE-321US
04

betroffene Produkte (14)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-240718SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V22012-09-13csaf · siemens_psirtDE

    SIMATIC S7-1200 CPU V2 devices contain an insufficiently protected private key used for the Certificate Authority (CA) for HTTPS connections. Possession of this key could allow remote attackers to spoof the device's web server by creating a forged web server certificate. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. Refer to the chapter Additional Information for more details.

  • ICSA-12-263-01Siemens S7-1200 Insecure Storage of HTTPS CA Certificate2012-06-23icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

06

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2012-09-25geändert 2026-06-16
09

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan