PT-2012-4124 · Siemens · Wincc

Andrey Medov + 7 · Published 2012-06-08 · Updated 2012-06-12 · CVE-2012-2596

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2

Description The issue concerns the XPath functionality in web applications, which does not properly handle special characters in parameters. This allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack.

Recommendations For Siemens WinCC version 7.0 SP3 before Update 2, update to a version that includes Update 2 to resolve the issue. As a temporary workaround, consider restricting access to the XPath functionality to minimize the risk of exploitation. Avoid using special characters in parameters for the affected web applications until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-2596

Affected Products

Wincc

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-2596 · Security Note
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-223158.pdf · Vendor Advisory
• http://us-cert.gov/control_systems/pdf/ICSA-12-158-01.pdf · Note