CVE-2012-3037

The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate.

Score

CVSS 2.0 4.3 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2012-09-25

Last modified

2025-05-23

Weaknesses

CWE-295

Affected products

• Simatic S7-1200 Cpu 1211c Firmware (Siemens)
• Simatic S7-1200 Cpu 1212c Firmware (Siemens)
• Simatic S7-1200 Cpu 1212fc Firmware (Siemens)
• Simatic S7-1200 Cpu 1214 Fc Firmware (Siemens)
• Simatic S7-1200 Cpu 1214c Firmware (Siemens)
• Simatic S7-1200 Cpu 1215 Fc Firmware (Siemens)
• Simatic S7-1200 Cpu 1215c Firmware (Siemens)
• Simatic S7-1200 Cpu 1217c Firmware (Siemens)
• Simatic S7-1200 Firmware (Siemens)

References

• http://en.securitylab.ru/lab/PT-2012-48
• http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-240718.pdf
• http://www.us-cert.gov/control_systems/pdf/ICSA-12-263-01.pdf