8.5
CVE-2011-4879
- EPSS 42.39%
- Veröffentlicht 03.02.2012 20:55:02
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle cret@cert.org
- Teams Watchlist Login
- Unerledigt Login
miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does not properly handle URIs beginning with a 0xfa character, which allows remote attackers to read data from arbitrary memory locations or cause a denial of service (application crash) via a crafted POST request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Wincc Flexible Version2004
Siemens ≫ Wincc Flexible Version2005
Siemens ≫ Wincc Flexible Version2007
Siemens ≫ Wincc Flexible Version2008
Siemens ≫ Wincc Flexible Version2008 Updatesp1
Siemens ≫ Wincc Flexible Version2008 Updatesp2
Siemens ≫ Simatic Hmi Panels Versioncomfort_panels
Siemens ≫ Simatic Hmi Panels Versionmobile_panels
Siemens ≫ Simatic Hmi Panels Versionmp
Siemens ≫ Simatic Hmi Panels Versionop
Siemens ≫ Simatic Hmi Panels Versiontp
Siemens ≫ Wincc Runtime Advanced Versionv11
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 42.39% | 0.974 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.5 | 10 | 7.8 |
AV:N/AC:L/Au:N/C:P/I:N/A:C
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.