PT-2012-1202 · Siemens · Simatic S7-1200 Plcs

Publicado 2012-10-08 · Atualizado 2022-02-01 · CVE-2012-3040

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1200 PLCs versions 2.x through 3.0.1

Description The issue is related to a lack of protection measures for the web server, allowing for the exploitation of a cross-site scripting (XSS) vulnerability. This vulnerability enables a remote attacker to inject arbitrary web script or HTML via a crafted URI, potentially leading to the execution of malicious JavaScript code.

Recommendations For versions 2.x through 3.0.1, consider disabling the web server functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the web server to minimize the risk of remote attackers injecting malicious scripts. Avoid using crafted URIs that could trigger the vulnerability.

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

BDU:2020-02448

CVE-2012-3040

Produtos afetados

Simatic S7-1200 Plcs

Referências · 10

• https://t.me/cvenotify/26108 · Publicação no Telegram
• https://securitylab.ru/lab/PT-2012-50 · Nota
• https://bdu.fstec.ru/vul/2020-02448 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-279823.pdf · Nota
• http://en.securitylab.ru/lab/PT-2012-50 · Nota
• http://us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3040 · Nota de Segurança
• http://osvdb.org/86130 · Nota
• http://secunia.com/advisories/50816 · Nota
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf · Aviso do Fabricante