Summary
Multiple versions of SIMATIC WinCC and SIMATIC PCS 7 do not properly handle certain requests to their web application (WinCC WebNavigator, PCS 7 Web Server, and PCS 7 Web Diagnostics Server), which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
Medium 5.9
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Profess…
Revision history
-
#3
Added fix for SIMATIC WinCC Runtime Professional V18
-
#2
Updated fix for SIMATIC PCS 7 V9.1
-
#1
Publication Date
References
-
SSA-883918: Information Disclosure Vulnerability in SIMATIC WinCC - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-883918.html