CVE-2014-4686

The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:simatic_pcs7::sp1::::::*
	cpe:2.3:a:siemens:simatic_pcs7:7.1:sp3::::::
	cpe:2.3:a:siemens:simatic_pcs7:8.0:::::::*
	cpe:2.3:a:siemens:wincc::::::::
	cpe:2.3:a:siemens:wincc:5.0:::::::*
	cpe:2.3:a:siemens:wincc:5.0:sp1::::::
	cpe:2.3:a:siemens:wincc:6.0:::::::*
	cpe:2.3:a:siemens:wincc:6.0:sp2::::::
	cpe:2.3:a:siemens:wincc:6.0:sp3::::::
	cpe:2.3:a:siemens:wincc:6.0:sp4::::::
	cpe:2.3:a:siemens:wincc:7.0:::::::*
	cpe:2.3:a:siemens:wincc:7.0:sp1::::::
	cpe:2.3:a:siemens:wincc:7.0:sp2::::::
	cpe:2.3:a:siemens:wincc:7.0:sp3::::::
	cpe:2.3:a:siemens:wincc:7.1:::::::*
	cpe:2.3:a:siemens:wincc:7.1:sp1::::::

History

No history.

Information

Published : 2014-07-24 14:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-4686

Mitre link : CVE-2014-4686

CVE.ORG link : CVE-2014-4686

JSON object : View

Products Affected

siemens

wincc
simatic_pcs7

CWE

NVD-CWE-Other

{"id": "CVE-2014-4686", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-07-24T14:55:08.190", "references": [{"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-214365.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The Project administration application in Siemens SIMATIC WinCC before 7.3, as used in PCS7 and other products, has a hardcoded encryption key, which allows remote attackers to obtain sensitive information by extracting this key from another product installation and then employing this key during the sniffing of network traffic on TCP port 1030."}, {"lang": "es", "value": "La aplicaci\u00f3n de administraci\u00f3n del proyecto en Siemens SIMATIC WinCC anterior a 7.3, utilizado en PCS7 y otros productos, tiene una clave de codificaci\u00f3n embebida, lo que permite a atacantes remotos obtener informaci\u00f3n sensible mediante la extracci\u00f3n de esta clave de otra instalaci\u00f3n del producto y la posterior utilizaci\u00f3n de esta clave durante la captura de trafico de la red en puerto TCP 1030."}], "lastModified": "2014-07-25T14:59:40.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_pcs7:*:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0165209F-7378-4C05-9373-ECA6EA57697D", "versionEndIncluding": "8.0"}, {"criteria": "cpe:2.3:a:siemens:simatic_pcs7:7.1:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33FA164B-E269-4140-AC85-2623356AF636"}, {"criteria": "cpe:2.3:a:siemens:simatic_pcs7:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8B894F4-9635-4436-BC0A-E43280426017"}, {"criteria": "cpe:2.3:a:siemens:wincc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74484B5D-121B-4838-9072-019532E78A03", "versionEndIncluding": "7.2"}, {"criteria": "cpe:2.3:a:siemens:wincc:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4CB277F-7ECB-4F44-8BB5-A3D350486EE7"}, {"criteria": "cpe:2.3:a:siemens:wincc:5.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "616535F1-F609-408B-AE48-61ACF48748A1"}, {"criteria": "cpe:2.3:a:siemens:wincc:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F322FCB-32F4-4C5A-A7F5-F7EF41188C88"}, {"criteria": "cpe:2.3:a:siemens:wincc:6.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69822DB4-DC79-4F88-A470-5AC512C77377"}, {"criteria": "cpe:2.3:a:siemens:wincc:6.0:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "996DE8BD-DD51-41EF-9882-C2BD2CC5FE53"}, {"criteria": "cpe:2.3:a:siemens:wincc:6.0:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "945C8B46-4CDA-4143-889C-30E30E93DB29"}, {"criteria": "cpe:2.3:a:siemens:wincc:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A33F9015-7058-419A-8762-CB2AE4ACF1A7"}, {"criteria": "cpe:2.3:a:siemens:wincc:7.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6271FCC-CCF6-4D31-801A-B4B0DC4639DD"}, {"criteria": "cpe:2.3:a:siemens:wincc:7.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF7A6B2B-D573-4285-B3B4-136F2BE7E710"}, {"criteria": "cpe:2.3:a:siemens:wincc:7.0:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "111D0F4D-2B67-46E8-BF8D-5D30EFE561EE"}, {"criteria": "cpe:2.3:a:siemens:wincc:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B16BB99-49E0-443E-BEE0-C7694D2C54E1"}, {"criteria": "cpe:2.3:a:siemens:wincc:7.1:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4115260-50FC-40C9-81CF-4D9F97394627"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/798.html\" target=\"_blank\">CWE-798: CWE-798: Use of Hard-coded Credentials</a>", "sourceIdentifier": "cve@mitre.org"}