PT-2016-7550 · Siemens · Simatic Cp 443-1 Advanced+3
Published
2016-11-23
·
Updated
2019-12-12
·
CVE-2016-8673
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) versions prior to V3.0.53
SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) versions prior to V3.2.17
SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (affected versions not specified)
SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (affected versions not specified)
Description
A vulnerability has been identified that could allow remote attackers to perform actions with the permissions of an authenticated user. This is possible if the targeted user has an active session and is induced to trigger the malicious request, exploiting the integrated web server at port 80/TCP or port 443/TCP of the affected devices.
Recommendations
For SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) versions prior to V3.0.53, update to version V3.0.53 or later.
For SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) versions prior to V3.2.17, update to version V3.2.17 or later.
For SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) and SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants), at the moment, there is no information about a newer version that contains a fix for this vulnerability.
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simatic Cp 343-1 Advanced
Simatic Cp 443-1 Advanced
Simatic S7-300 Pn/Dp Cpu
Simatic S7-400 Pn Cpu