PT-2014-1218 · Siemens · Simatic Wincc

Gleb Gritsai + 2 · Published 2014-02-06 · Updated 2017-08-29 · CVE-2014-1697

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC OA versions prior to 3.12 P002 January

Description The issue is related to the integrated web server in Siemens SIMATIC WinCC OA, which allows remote attackers to execute arbitrary code via crafted packets sent to TCP port 4999. This is due to errors that occur when processing specially formed TCP packets, enabling an attacker to exploit the issue and execute arbitrary code by sending crafted packets to the specified port.

Recommendations For versions prior to 3.12 P002 January, update to version 3.12 P002 January or later to resolve the issue. As a temporary workaround, consider restricting access to TCP port 4999 to minimize the risk of exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2014-00391

CVE-2014-1697

Affected Products

Simatic Wincc

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-1697;%20http://osvdb.org/show/osvdb/102810;%20http://secunia.com/advisories/56651/;%20http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01;%20http://cnnvd.org.cn/vulnerability/show/cv_id/2014020087;%20http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf;%20http://securitylab.ru/lab/PT-2013-78 · Security Note
• https://bdu.fstec.ru/vul/2014-00391 · Security Note
• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-342587.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1697 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-035-01 · Note
• http://securityfocus.com/bid/65351 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90933 · Note
• http://osvdb.org/102810 · Note
• http://secunia.com/advisories/56651 · Note