Skip to content
OpenAdvisories
Critical ICSA-12-030-01A 12 CVEs

Siemens SIMATIC WinCC Vulnerabilities

Published Nov 2, 2012 · Updated Jun 9, 2025 · Revision 2

Vendor: Siemens Product: Multiple SIMATIC HMI panels (TP, OP, MP, Comfort Panels, Mobile Panels) Product: WinCC flexible Product: WinCC flexible Runtime Product: WinCC V11 (TIA portal) Product: WinCC V11 Runtime Advanced

Vulnerabilities 12

  • Unscored —
    CVE-2011-4508

    The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before S…

  • Unscored —
    CVE-2011-4509

    The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Co…

  • Unscored —
    CVE-2011-4510

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 bef…

  • Unscored —
    CVE-2011-4511

    Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 bef…

  • Unscored —
    CVE-2011-4512

    CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; Win…

  • Unscored —
    CVE-2011-4513

    Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobi…

  • Unscored —
    CVE-2011-4514

    The TELNET daemon in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Com…

  • Unscored —
    CVE-2011-4875 Public exploit EPSS 14%

    Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinC…

  • Unscored —
    CVE-2011-4876 Public exploit

    Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008…

  • Unscored —
    CVE-2011-4877 Public exploit

    HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP,…

  • Unscored —
    CVE-2011-4878 Public exploit EPSS 11%

    Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and …

  • Unscored —
    CVE-2011-4879 Public exploit EPSS 12%

    miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA p…

Revision history

  1. #2

    Advisory converted into a CSAF

  2. #1

    Initial Publication

References