PT-2012-1202 · Siemens · Simatic S7-1200 Plcs

Published 2012-10-08 · Updated 2022-02-01 · CVE-2012-3040

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1200 PLCs versions 2.x through 3.0.1

Description The issue is related to a lack of protection measures for the web server, allowing for the exploitation of a cross-site scripting (XSS) vulnerability. This vulnerability enables a remote attacker to inject arbitrary web script or HTML via a crafted URI, potentially leading to the execution of malicious JavaScript code.

Recommendations For versions 2.x through 3.0.1, consider disabling the web server functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the web server to minimize the risk of remote attackers injecting malicious scripts. Avoid using crafted URIs that could trigger the vulnerability.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2020-02448

CVE-2012-3040

Affected Products

Simatic S7-1200 Plcs

References · 10

• https://bdu.fstec.ru/vul/2020-02448 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3040 · Security Note
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-279823.pdf · Vendor Advisory
• https://t.me/cvenotify/26108 · Telegram Post
• https://securitylab.ru/lab/PT-2012-50 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-279823.pdf · Note
• http://en.securitylab.ru/lab/PT-2012-50 · Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-283-01.pdf · Note
• http://osvdb.org/86130 · Note
• http://secunia.com/advisories/50816 · Note