Unscored severity · published Sep 18, 2012
CVE-2012-3028
Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to hijack…
–
CVSS
1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that modify data or cause a denial of service.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Simatic Pcs7 · Siemens
8.0 · source: NVD
WI
Wincc · Siemens
through 7.0; 5.0; 5.0; 6.0; 6.0; 6.0; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3028
en.securitylab.ru
http://en.securitylab.ru/lab/PT-2012-42
Patch
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-864051.pdf
www.us-cert.gov
http://www.us-cert.gov/control_systems/pdf/ICSA-12-256-01.pdf
More from Simatic Pcs7
8.2
CVE-2017-12069
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367
6.4
CVE-2016-7165
A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software…
4.9
CVE-2017-14023
An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versions
–
CVE-2014-8552
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13…
–
CVE-2014-8551
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13…