CVE-2014-2908

Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2014-04-25

Last modified

2024-08-06

Weaknesses

CWE-79

Affected products

• Simatic S7 Cpu-1211c (Siemens)
• Simatic S7 Cpu 1200 Firmware (Siemens)
• Simatic S7 Cpu 1212c (Siemens)
• Simatic S7 Cpu 1214c (Siemens)
• Simatic S7 Cpu 1215c (Siemens)
• Simatic S7 Cpu 1217c (Siemens)

References

• http://ics-cert.us-cert.gov/advisories/ICSA-14-114-02
• http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-892012.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-892012.pdf
• https://www.exploit-db.com/exploits/44687/