CVEvulnerability
CVE-2013-0676
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-03-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly assign privileges for the database containing WebNavigator credentials, which allows remote authenticated users to obtain sensitive information via a SQL query.
Affected configurations
• siemens simatic pcs7 (<= 8.0)
• siemens simatic pcs7 7.1
• siemens wincc (<= 7.1)
• siemens wincc 5.0
• siemens wincc 6.0
• siemens wincc 7.0
Related
Weakness · not in database (1)
References
- http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf US Government Resource
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Vendor Advisory
- http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf US Government Resource
- http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf Vendor Advisory