PT-2014-8613 · Siemens · Tia Portal+2

Published 2014-11-26 · Updated 2014-11-26 · CVE-2014-8552

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC versions 7.0 through 7.0 SP3 Siemens SIMATIC WinCC versions 7.2 through 7.2 before Update 9 Siemens SIMATIC WinCC versions 7.3 through 7.3 before Update 2 Siemens SIMATIC PCS 7 versions 7.1 through 7.1 SP4 Siemens SIMATIC PCS 7 versions 8.0 through 8.0 SP2 Siemens SIMATIC PCS 7 version 8.1 Siemens TIA Portal versions 13 through 13 before Update 6

Description The issue allows remote attackers to read arbitrary files via crafted packets.

Recommendations For Siemens SIMATIC WinCC versions 7.0 through 7.0 SP3, update to a version after SP3. For Siemens SIMATIC WinCC versions 7.2 through 7.2 before Update 9, update to Update 9 or later. For Siemens SIMATIC WinCC versions 7.3 through 7.3 before Update 2, update to Update 2 or later. For Siemens SIMATIC PCS 7 versions 7.1 through 7.1 SP4, update to a version after SP4. For Siemens SIMATIC PCS 7 versions 8.0 through 8.0 SP2, update to a version after SP2. For Siemens SIMATIC PCS 7 version 8.1, apply the necessary patch or update. For Siemens TIA Portal versions 13 through 13 before Update 6, update to Update 6 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-8552

Affected Products

Simatic Pcs 7

Simatic Wincc

Tia Portal

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-8552 · Security Note
• http://siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-134508.pdf · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8552 · Note