Summary
SIMATIC S7-1200 CPU V2 devices contain an insufficiently protected private key used for the Certificate Authority (CA) for HTTPS connections. Possession of this key could allow remote attackers to spoof the device's web server by creating a forged web server certificate.
Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Refer to the chapter Additional Information for more details.
Vulnerabilities 1
-
Unscored —
The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification A…
Revision history
-
#3
Used CVE ID (CVE-2012-3037) instead of the deprecated SVE ID (SVE-2012-0003); Corrected CVSS vector of CVE-2012-3037; Updated SSA to current data model and support of csaf
-
#2
SIPLUS devices now explicitly mentioned in the list of affected products
-
#1
Publication Date
References
-
SSA-240718: Insecure Storage of HTTPS CA Certificate in SIMATIC S7-1200 CPU V2 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-240718.html