CVE-2012-3037

mediumpriority · track · 18OT risk · elevatedEPSS 0.015 · 74 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.47% (74th) EPSS
CVSS 4.3 · medium
Is it mine?
14 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-28

The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • MitigationSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)siemens_psirt

    Uninstall the affected CA keys from the browser's certificate store.

  • MitigationSIMATIC S7-1200cisa_csaf_ot

    Siemens strongly recommends the user uninstall the CA signing keys from the Web browser’s certificate store. The procedure for performing this task is specific to each browser. Once this is performed, warning messages will occur when attempting to connect to an S7-1200 PLC. The user can manually confirm the identity of the PLC and accept its certificate via the browser. This has to be done once for each S7-1200 PLC on the network.

  • No fix plannedSIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants)siemens_psirt

    Currently no fix is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

9.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 3.7–9.3

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v2.09.3criticalAV:N/AC:M/Au:N/C:C/I:C/A:Csecondary · CISA US
v2.03.7lowAV:N/AC:M/Au:N/C:P/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.3highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Siemens ProductCERT DE
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USprimaryCWE-295USCWE-311USCWE-321US
04

affected products (14)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SSA-240718SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V22012-09-13csaf · siemens_psirtDE

    SIMATIC S7-1200 CPU V2 devices contain an insufficiently protected private key used for the Certificate Authority (CA) for HTTPS connections. Possession of this key could allow remote attackers to spoof the device's web server by creating a forged web server certificate. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. Refer to the chapter Additional Information for more details.

  • ICSA-12-263-01Siemens S7-1200 Insecure Storage of HTTPS CA Certificate2012-06-23icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
published 2012-09-25modified 2026-06-16
09

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan