PT-2015-5233 · Siemens · Simatic Wincc Flexible+1

Aleksandr Tlyapov + 5 · Publicado 2015-02-18 · Atualizado 2016-11-30 · CVE-2015-1358

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC (TIA Portal) versions prior to 13 SP1 Siemens SIMATIC WinCC flexible versions prior to 2008 SP3 Up7

Description The issue concerns the remote-management module in certain Siemens products, where credentials are not properly encrypted in transit. This makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.

Recommendations For Siemens SIMATIC WinCC (TIA Portal) versions prior to 13 SP1, update to version 13 SP1 or later. For Siemens SIMATIC WinCC flexible versions prior to 2008 SP3 Up7, update to version 2008 SP3 Up7 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-1358

Produtos afetados

Simatic Wincc

Simatic Wincc Flexible

Referências · 6

• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1358 · Nota de Segurança
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf · Nota
• http://securityfocus.com/bid/72625 · Nota
• http://securitytracker.com/id/1036090 · Nota