PT-2014-1955 · Siemens · Simatic S7-1500 Cpu+1

Aleksandr Timorin + 4 · Published 2014-03-16 · Updated 2014-03-26 · CVE-2014-2249

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0 Siemens SIMATIC S7-1200 CPU PLC devices versions prior to 4.0

Description A cross-site request forgery (CSRF) issue affects the software, allowing remote attackers to hijack the authentication of victims via unknown vectors. The vulnerability is also described as affecting the embedded server of the Simatic S7-1200 programmable logic controller, specifically on port 80 TCP and port 443 TCP, enabling cross-site request forgery.

Recommendations For Siemens SIMATIC S7-1500 CPU PLC devices versions prior to 1.5.0, update the firmware to version 1.5.0 or later. For Siemens SIMATIC S7-1200 CPU PLC devices versions prior to 4.0, update the firmware to version 4.0 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2015-10402

CVE-2014-2249

Affected Products

Simatic S7-1200 Cpu

Simatic S7-1500 Cpu

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2014-2249 · Security Note
• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10402 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01 · Note
• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf · Note
• http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-14-079-02 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf · Note