medium4.3Public exploit code
CVE-2014-2908
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting2018-05-22 · webapps · linux
Impact
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Siemens | Simatic S7 Cpu 1200 Firmware | Versions 2.0, 3.0, 3.0.2 |
| Siemens | Simatic S7 Cpu-1211c | All versions |
| Siemens | Simatic S7 Cpu 1212c | All versions |
| Siemens | Simatic S7 Cpu 1214c | All versions |
| Siemens | Simatic S7 Cpu 1215c | All versions |
| Siemens | Simatic S7 Cpu 1217c | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
- https://www.exploit-db.com/exploits/44687/
- http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02
- http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
- https://www.exploit-db.com/exploits/44687/