PT-2013-1459 · Siemens · Siemens Wincc

Published 2013-03-21 · Updated 2013-05-31 · CVE-2011-4515

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens WinCC (TIA Portal) version 11

Description The issue allows local users to obtain sensitive information by leveraging physical access or Sm@rt Server access, due to the use of a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files.

Recommendations For version 11, consider restricting access to the world-readable and world-writable files to minimize the risk of exploitation. As a temporary workaround, limit physical access and Sm@rt Server access to the system until a more secure password storage mechanism is implemented.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2011-4515

Affected Products

Siemens Wincc

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4515 · Security Note
• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf · Vendor Advisory
• http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf · Note